Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27/11/2022, 06:45
General
-
Target
bwwxyxw_gr/reg.exe
-
Size
5.5MB
-
MD5
bbbcfa4e934122ba0a96a9dff367cf5b
-
SHA1
3346a1ed1fdb4c33bc1956338f79f08f6dd34f26
-
SHA256
e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1
-
SHA512
76d337708b20086888e5f3037d29f8a37bfd98f9eff125f6f2dd4bb5ae823c1ac76cebe54383bbb8ce038d27bf7f86bf96c6f585e21bf7c1c80e9b7317e63337
-
SSDEEP
98304:WGdZusmwYqdwkLcHHj5SbWf+YFCNK1oLZliOuz5+If9kuPJGGf6iOdDEvJ:v5jAjQaf+HNKcqkwG46Jw
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bwwxyxw_gr\reg.exe"C:\Users\Admin\AppData\Local\Temp\bwwxyxw_gr\reg.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
-
Filesize
5.5MB
-
Filesize
48KB
-
Filesize
1.5MB
-
Filesize
244KB
-
Filesize
5.5MB