Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 08:36

General

  • Target

    6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe

  • Size

    73KB

  • MD5

    5cc335f8d6ddfaf90050c6beae9de621

  • SHA1

    c161a9917ff72da818ea5ba661b4dee1e726d6d9

  • SHA256

    6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d

  • SHA512

    03a10039c2b9aa00cc0fd2ba7099527618fb035541a03306640e83d3a80fdb26b65a711306dfac4add22e7a414651671301eb5e5decb556d68512986d590a28f

  • SSDEEP

    1536:+X8aN37X4GpkvCVzLVKNrKNsKNaKN6X1C:+d7oGmaVzLYNWNLNBNI1C

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
    "C:\Users\Admin\AppData\Local\Temp\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\ProgramData\pcdfdata\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
      C:\ProgramData\pcdfdata\6ff418ebecec9fce66f8cee635fb6767381382401b9910bdd094bd39baf1f43d.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        3⤵
          PID:4328

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2308-135-0x00000000004B0000-0x00000000004B7000-memory.dmp

      Filesize

      28KB

    • memory/2308-136-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/2308-142-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/2708-133-0x0000000002030000-0x0000000002037000-memory.dmp

      Filesize

      28KB

    • memory/2708-134-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

    • memory/4328-137-0x00000000008C0000-0x00000000008C1000-memory.dmp

      Filesize

      4KB