Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

6bb3ca3d82...8c.exe

windows7-x64

8

6bb3ca3d82...8c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 12:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6bb3ca3d8288780dc6de3c7fb3fe1231b515af3e10ce6817a8a8cefd038fdc8c.exe

  • Size

    450KB

  • MD5

    936e746eddb5964577a03503ce211c20

  • SHA1

    4692591c213bae269d7f29bf73890d69f34d6656

  • SHA256

    6bb3ca3d8288780dc6de3c7fb3fe1231b515af3e10ce6817a8a8cefd038fdc8c

  • SHA512

    b44a17818ad4b5cc46ca29ce75e7d95a8a591effdcb530308dc46fdd5c954eba78f2d4e91269cd83b711444b8237055ea93c1a4f153ecabc06e292844a68a703

  • SSDEEP

    12288:7b+3qlLmZ6/0THZd+NBT6LFhKOVkeQXOjtsDF2:fPLo6/4HX+NBWL9ke9Z

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bb3ca3d8288780dc6de3c7fb3fe1231b515af3e10ce6817a8a8cefd038fdc8c.exe
    "C:\Users\Admin\AppData\Local\Temp\6bb3ca3d8288780dc6de3c7fb3fe1231b515af3e10ce6817a8a8cefd038fdc8c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\ProgramData\kG01803JmMhG01803\kG01803JmMhG01803.exe
      "C:\ProgramData\kG01803JmMhG01803\kG01803JmMhG01803.exe" "C:\Users\Admin\AppData\Local\Temp\6bb3ca3d8288780dc6de3c7fb3fe1231b515af3e10ce6817a8a8cefd038fdc8c.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4712

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\kG01803JmMhG01803\kG01803JmMhG01803.exe
    Filesize

    450KB

    MD5

    e2e86d38c6243bfee887fd3399532a8a

    SHA1

    14d4d92f7d462c4930f0c31af71406c033f444e4

    SHA256

    ce4c4c5c1651727003652815bef0214b021b2413c6f7b2cca11ec460a48b27e7

    SHA512

    2f76aa7c905eee34ea01a8160bc879724b7facb9c2204467ecfc1525a853cde2727bbc612a9755fad947c282da148403d9c3acbc6bdbb9bba4c848096a7db596

    Download Submit

  • C:\ProgramData\kG01803JmMhG01803\kG01803JmMhG01803.exe
    Filesize

    450KB

    MD5

    e2e86d38c6243bfee887fd3399532a8a

    SHA1

    14d4d92f7d462c4930f0c31af71406c033f444e4

    SHA256

    ce4c4c5c1651727003652815bef0214b021b2413c6f7b2cca11ec460a48b27e7

    SHA512

    2f76aa7c905eee34ea01a8160bc879724b7facb9c2204467ecfc1525a853cde2727bbc612a9755fad947c282da148403d9c3acbc6bdbb9bba4c848096a7db596

    Download Submit

  • memory/4712-138-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4712-139-0x000000000070D000-0x000000000075A000-memory.dmp

    Filesize

    308KB

    Download

  • memory/4712-140-0x000000000070D000-0x000000000075A000-memory.dmp

    Filesize

    308KB

    Download

  • memory/4972-132-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

    Download

  • memory/4972-133-0x000000000061D000-0x000000000066A000-memory.dmp

    Filesize

    308KB

    Download

  • memory/4972-137-0x0000000000400000-0x00000000004C2000-memory.dmp

    Filesize

    776KB

    Download