Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29/10/2022, 00:04
General
-
Target
d24c468dd320f4be33f4ccf13839955b4100208c40628135335aabd8491a9249.exe
-
Size
259KB
-
MD5
0124d024d73f2757a8ed6d7ff60e1c60
-
SHA1
9485d27c7c4ae77c1fb234bc852cdecfffb1bcc5
-
SHA256
d24c468dd320f4be33f4ccf13839955b4100208c40628135335aabd8491a9249
-
SHA512
c8e211ab803a467e2152c4e1e6a2dc65ba6af93d45d7be288c278a8eb886aa45cbfd4d14362ae2f4bbcfd3239eadc07a986104b4edc48a56df2914cefa1ceb57
-
SSDEEP
6144:QyK4+vW9EnkxPWu9oYUkZYeLoerbZP4sdA9hmEPpW5rpH:3K99kPWqBU0LDrNgsdA9hFPW9
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d24c468dd320f4be33f4ccf13839955b4100208c40628135335aabd8491a9249.exe"C:\Users\Admin\AppData\Local\Temp\d24c468dd320f4be33f4ccf13839955b4100208c40628135335aabd8491a9249.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
-
Filesize
360KB
-
Filesize
420KB
-
Filesize
360KB
-
Filesize
712KB
-
Filesize
736KB