Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 10:44

General

  • Target

    27270ac73a4646bb6856fef535f555d6193fc763e90326c5c65aa48ae2b9f67e.exe

  • Size

    73KB

  • MD5

    70a618bd04328bbb110d1208962a99e7

  • SHA1

    b25e030bf9f80748201f522e7aff4320d182045e

  • SHA256

    27270ac73a4646bb6856fef535f555d6193fc763e90326c5c65aa48ae2b9f67e

  • SHA512

    86386aba85fd4037497c23954b447795a86399b121c938dd62ee3b00ad0df2201502c10e6f0240b52168b1c8c3baa0dfd5a332b3cefb1dd95540d23a1220ec64

  • SSDEEP

    768:/0l6fk0Ykrxxrzh904BPk3yeDjzexnQi2/jcpVA3B6UX:Ml6rxrxxrT04u+xnQlwpS3B6g

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27270ac73a4646bb6856fef535f555d6193fc763e90326c5c65aa48ae2b9f67e.exe
    "C:\Users\Admin\AppData\Local\Temp\27270ac73a4646bb6856fef535f555d6193fc763e90326c5c65aa48ae2b9f67e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 820
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4892-132-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/4892-134-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB