Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
21/10/2022, 01:18
General
-
Target
685472de17cb79bf222d897ed16ac979b92798ed5411ace7de7fd148076f87ee.exe
-
Size
600KB
-
MD5
76c103f09a730f5f981e56298ac15c20
-
SHA1
7c552b010f36fcbebb1abea43ebbc7d1c0ea2168
-
SHA256
685472de17cb79bf222d897ed16ac979b92798ed5411ace7de7fd148076f87ee
-
SHA512
590b7f01ebc322750897062614c584a783d41c6133083130392abc5da08119b0f04403a0010c3964f9034405eaaf2275936d8354459a12cae04ea60da9ab0a4a
-
SSDEEP
12288:u2NO/qp9MmeLwKuTp/Uuz8191zKsCPzlFWgNEOsqQkClpobA:u3qp93Cop/Uuq91jcSDxq+Sc
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\685472de17cb79bf222d897ed16ac979b92798ed5411ace7de7fd148076f87ee.exe"C:\Users\Admin\AppData\Local\Temp\685472de17cb79bf222d897ed16ac979b92798ed5411ace7de7fd148076f87ee.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB