Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 13:19

General

  • Target

    9282ab93e05542257718364ea8a0b0da46a27d481ae47c6ed6f3d570ca7f8784.exe

  • Size

    325KB

  • MD5

    3a739fe80f3e5b11498a9cf23ffd99b3

  • SHA1

    3d1e13908e42bb97756f7be93ff567276621636f

  • SHA256

    9282ab93e05542257718364ea8a0b0da46a27d481ae47c6ed6f3d570ca7f8784

  • SHA512

    2bf4b81e0047fc632008e32304b9546fe55ebffad1a33e4ef78b08306bd70c01a9d0c7cdaccc107f04d752272a5af2acbf830fa19baf7157186e55c65e04c800

  • SSDEEP

    6144:xQl313aAKsdIT+LmZmz6dQ0np2q17TqnX4En0C4W9haUlok:6lF3Mn6LY+0npX1inX4ErzTok

Score
6/10

Malware Config

Signatures

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9282ab93e05542257718364ea8a0b0da46a27d481ae47c6ed6f3d570ca7f8784.exe
    "C:\Users\Admin\AppData\Local\Temp\9282ab93e05542257718364ea8a0b0da46a27d481ae47c6ed6f3d570ca7f8784.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:4544
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:2140

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4544-132-0x0000000001B90000-0x0000000001C90000-memory.dmp

    Filesize

    1024KB

  • memory/4544-133-0x0000000001C90000-0x0000000001CBF000-memory.dmp

    Filesize

    188KB

  • memory/4544-137-0x00000000024D0000-0x00000000024F7000-memory.dmp

    Filesize

    156KB