Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    80s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 15:44

General

  • Target

    777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb.exe

  • Size

    1.1MB

  • MD5

    5deb72103587faa2479065d6e2dd3460

  • SHA1

    04c71086f3e69e73ab3c3f3e013d422884656e14

  • SHA256

    777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb

  • SHA512

    71aa67992fc2ed0e7775a24e4165eb3e243eac86f8a0186c3928594b2d9b94dda6a4d6058c2940df38e08c4e05092a9fd9c026aa5719f80d9509dbea77bb95fb

  • SSDEEP

    12288:UnwuWGyqJEjVAFR9QCIAAKK2GhouKx2RnglGAEqnjFGRueuFAB6hSFCG+5NNpDQL:mm8QCIN/LKxcIEDRueMEox9pDQKC

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb.exe
    "C:\Users\Admin\AppData\Local\Temp\777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Suspicious behavior: EnumeratesProcesses
    PID:1728

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1728-132-0x00000000023D0000-0x00000000024C6000-memory.dmp

    Filesize

    984KB

  • memory/1728-133-0x00000000023D0000-0x00000000024C6000-memory.dmp

    Filesize

    984KB

  • memory/1728-135-0x00000000023D0000-0x00000000023D5000-memory.dmp

    Filesize

    20KB

  • memory/1728-134-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/1728-136-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB