Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 10:16

General

  • Target

    6becfd9c466ebf9c429c16fd60b83f337c7a66b14b7f2aaf462337eb93411e0a.exe

  • Size

    789KB

  • MD5

    3b88560f49cad9aff928a1efe33b0980

  • SHA1

    0188a38250a5c6c8e1649281f753982dda49effe

  • SHA256

    6becfd9c466ebf9c429c16fd60b83f337c7a66b14b7f2aaf462337eb93411e0a

  • SHA512

    3743a24e283683c328db6029905684a13f3ae931701230c466d7ab745f3e53b5940392343bb9db2f2e8912e5ac931e0d64f136808e6da0c2ee92b804351700b3

  • SSDEEP

    12288:GSP2Vu2On5XQlE983JNsUDvlkd73hS3n8H5PGFAyG/Q7wvP+:R/2On5XakphS305P4An/9X+

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6becfd9c466ebf9c429c16fd60b83f337c7a66b14b7f2aaf462337eb93411e0a.exe
    "C:\Users\Admin\AppData\Local\Temp\6becfd9c466ebf9c429c16fd60b83f337c7a66b14b7f2aaf462337eb93411e0a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfsF69A.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • C:\Users\Admin\AppData\Local\Temp\dfsF69A.tmp

    Filesize

    537KB

    MD5

    ff7eef4dfcc3c54deb1bb962d39b5ad9

    SHA1

    7125758b5088e41160ae6d04a30ed20b842fdc7b

    SHA256

    65534417c3d94effdc940ee2cbcc57adb81b00f9584a4f3f4cc6f5d5f9ed18a9

    SHA512

    e0cfcd65d21dc8094782a09202ca26365d15c258992cc96045760a2393c979cc3db0236572efd3ae634fab48bb85557db12e07740687e8c69706d13d4682e142

  • memory/4880-134-0x0000000004FB0000-0x000000000503C000-memory.dmp

    Filesize

    560KB

  • memory/4880-135-0x0000000005880000-0x0000000005E24000-memory.dmp

    Filesize

    5.6MB

  • memory/4880-136-0x0000000005370000-0x0000000005402000-memory.dmp

    Filesize

    584KB

  • memory/4880-137-0x0000000005410000-0x000000000541A000-memory.dmp

    Filesize

    40KB

  • memory/4880-138-0x00000000094E0000-0x0000000009546000-memory.dmp

    Filesize

    408KB

  • memory/4880-139-0x000000000E6A0000-0x000000000EE46000-memory.dmp

    Filesize

    7.6MB