Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 18:29

General

  • Target

    5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe

  • Size

    451KB

  • MD5

    b0e2c156b901a5a87e947fea1ff56316

  • SHA1

    dc3761398275dedca78517dcaa61e281eef1ca51

  • SHA256

    5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e

  • SHA512

    7a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d

  • SSDEEP

    6144:SvaqS4IR/kviXzd4twM19AwCflNKBek0egb3CZF8/yoYZeiEzK4NKzLBM4cUvpSp:h/kviXzdtmJwNKBekM3GoYTEDeBf40bI

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe
    "C:\Users\Admin\AppData\Local\Temp\5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe
      "C:\Users\Admin\AppData\Local\Temp\\hpigpwdrymrp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hpigpwdrymrp.exe

    Filesize

    11KB

    MD5

    8a1240360271b11d7be8e579c8aae55a

    SHA1

    d5f399cea2aae630772f1090c83b3e3353ed833f

    SHA256

    81b9fdc86475fe81c05f0feeef0b233e1386802a57c7050f63409181b5feb827

    SHA512

    f1baf606ef670a94467962d95ab21fcb7257acdc5409d1430d15c2bc03bf7391f76c37a657f9cb0e7420a1cf3c34d430b022e1932701cad4504e7c2f08d0ac81

  • C:\Users\Admin\AppData\Local\Temp\parent.txt

    Filesize

    451KB

    MD5

    b0e2c156b901a5a87e947fea1ff56316

    SHA1

    dc3761398275dedca78517dcaa61e281eef1ca51

    SHA256

    5f6005a108b4ad7b5c72398dc9111945216daef1d5b632426a1805be288a185e

    SHA512

    7a25c6b76be11c53748191849f236754947df0d14095f12319120cbbbcfc7dc655d544a85862dcd83f21db46971abd521897378c82cca86a51b43767935ca82d

  • memory/3804-134-0x00007FFCA9460000-0x00007FFCA9E96000-memory.dmp

    Filesize

    10.2MB

  • memory/3804-136-0x000000000183A000-0x000000000183F000-memory.dmp

    Filesize

    20KB

  • memory/3804-137-0x000000000183A000-0x000000000183F000-memory.dmp

    Filesize

    20KB