Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe
Resource
win7-20220901-en
General
-
Target
a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe
-
Size
388KB
-
MD5
61073a533992cc053229dfb76cf68af2
-
SHA1
9433a3e2b076c641c4b1804ad50865ee82557e46
-
SHA256
a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2
-
SHA512
c0baee35a8be99bdd06f05731c6768870b713ce5d15e2091d63ec3f89393b31d9e21a8445d37cdc3f6c29f248484b160b1118f885ae74557a0a7b02afc43b271
-
SSDEEP
6144:devVsvNg7PtDS82rZ+60bBFf4K3fDPCdy/H/J0W/XUk9LZXC3voAgjkDyi:de2m7P1Y+HjfxP2k/h0WX9LEQeDyi
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe File opened for modification C:\Windows\assembly\Desktop.ini a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3376 set thread context of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe File created C:\Windows\assembly\Desktop.ini a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe File opened for modification C:\Windows\assembly\Desktop.ini a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1732 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe Token: SeDebugPrivilege 1732 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1732 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88 PID 3376 wrote to memory of 1732 3376 a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe"C:\Users\Admin\AppData\Local\Temp\a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe"C:\Users\Admin\AppData\Local\Temp\a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe"2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1732
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\a9a4064aba1816553cc7a0792fc647325f7c41f36bf3b5ccd8671d5eef807bd2.exe.log
Filesize607B
MD5f7ad994488d67d114896eb2b00df518b
SHA1c7889ecb59e9a6cc4a30c900bba199b65a3d1be6
SHA25611528062b8a5c775ecc682c7923384b34d9d74bb38473615550b50748b434a3b
SHA512ee1faba797120cdda67872d422b0aa5bc47cd1760b65fd9d6940eb877d6826c30a8a1e40fd91d0dd63e736a019200c47a1dd6479732509380fb4b7420edb8ba3