Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28/11/2022, 03:37
General
-
Target
17802b7ea044164f5f89d89ab8c7afd5c3a7a92373dc538688945e6f8e39a641.exe
-
Size
278KB
-
MD5
d0967914b98789b8c5a033e2e6a9a1f8
-
SHA1
bd6226241265548bacac3a288e654a2b52acf31b
-
SHA256
17802b7ea044164f5f89d89ab8c7afd5c3a7a92373dc538688945e6f8e39a641
-
SHA512
e97a9ea92864bc9cc9795b665a13be3862916a786de316801759c26ad85c78d3d053b8b7c3bfec201039f474d0471873cd6a11e3dd074fa35734951eb3d3db50
-
SSDEEP
6144:dQDds6bxOU8ytpJP/+HFLNSFpEBax8CqRZ:SDG6b98yJYNJax8Cq
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
-
Drops desktop.ini file(s) 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17802b7ea044164f5f89d89ab8c7afd5c3a7a92373dc538688945e6f8e39a641.exe"C:\Users\Admin\AppData\Local\Temp\17802b7ea044164f5f89d89ab8c7afd5c3a7a92373dc538688945e6f8e39a641.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Sets file execution options in registry
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x589C06E0" /TR "C:\ProgramData\randomfolder\uugbgiyxh.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
300KB
-
Filesize
152KB
-
Filesize
300KB
-
Filesize
1.6MB
-
Filesize
5.7MB
-
Filesize
4.8MB
-
Filesize
5.7MB
-
Filesize
4.8MB
-
Filesize
1.6MB
-
Filesize
5.7MB
-
Filesize
1.6MB
-
Filesize
492KB
-
Filesize
312KB
-
Filesize
312KB