Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 23:18

General

  • Target

    2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5.exe

  • Size

    789KB

  • MD5

    83a5dfdf3b0582a07b65a075d48ba730

  • SHA1

    c604afc592ce5018882fd7d058eeabeca4e702cd

  • SHA256

    2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5

  • SHA512

    9b2eb0d17a5d4f55b34b258ee223c811e9fc86182afb8c4bb7e16c5889bd402c9c683ddf2f917341a0dac337e370bc990bbc2f1a8765e7754447eb3c08fe903b

  • SSDEEP

    12288:mSP2Vu2On5XQlE983JNsUDvlkd73hS3n8H5PGFAyG/Q7wvT:x/2On5XakphS305P4An/97

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5.exe
    "C:\Users\Admin\AppData\Local\Temp\2055228256697d8e6c5630360340e9199afb2afe92e34fce28a65fb4043ecdb5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfs1C81.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • C:\Users\Admin\AppData\Local\Temp\dfs1C81.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • memory/1868-134-0x0000000005580000-0x000000000560C000-memory.dmp

    Filesize

    560KB

  • memory/1868-135-0x0000000005F80000-0x0000000006524000-memory.dmp

    Filesize

    5.6MB

  • memory/1868-136-0x00000000059D0000-0x0000000005A62000-memory.dmp

    Filesize

    584KB

  • memory/1868-137-0x0000000005950000-0x000000000595A000-memory.dmp

    Filesize

    40KB

  • memory/1868-138-0x0000000009C10000-0x0000000009C76000-memory.dmp

    Filesize

    408KB

  • memory/1868-139-0x000000000ED50000-0x000000000F4F6000-memory.dmp

    Filesize

    7.6MB