Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07/11/2022, 15:24
General
-
Target
f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c.exe
-
Size
90KB
-
MD5
0a199f56620cd5cc50770af98ec3e0c1
-
SHA1
c0101a37edf3892b3c3db059a60b8b2245254f0a
-
SHA256
f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c
-
SHA512
969353497e6e02983159e146117355b0b195977cab14960ca18c774feeffb09ab86335b2c687dc17e24db34860b3e51afced68a40e50c544cfbd30d4a46cb459
-
SSDEEP
1536:OROM9kCiFHcx3a4Cnu8RbVSholRbIcCsnj:ORWCi+Cn1VSholWcRn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c.exe"C:\Users\Admin\AppData\Local\Temp\f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkbs.exeC:\Windows\SysWOW64\Winkbs.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5649fb78bb3e2c4435f03fa06ea714f23
SHA1bfe71b0254e11f7496097977c2ed2384034744fd
SHA256a5afa73f83450dab3f268596f1c300e86183fd198e3a8aacbfa78497312919a2
SHA512a309fd4cd49b46f201234c4c0717782717456303fe866faece493968384a337fd3fb618526546e2febfbacf7a5376cc857b9b9ab41d44c181ebcaf9de682fd8a
-
Filesize
87KB
MD5649fb78bb3e2c4435f03fa06ea714f23
SHA1bfe71b0254e11f7496097977c2ed2384034744fd
SHA256a5afa73f83450dab3f268596f1c300e86183fd198e3a8aacbfa78497312919a2
SHA512a309fd4cd49b46f201234c4c0717782717456303fe866faece493968384a337fd3fb618526546e2febfbacf7a5376cc857b9b9ab41d44c181ebcaf9de682fd8a