Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 03:46

General

  • Target

    f7eaccc3f4b306591958f77a03564e042071a9d97f58fee8af3f646e097c43a6.exe

  • Size

    172KB

  • MD5

    4ac89b73c3f84b1b411039e69b3db190

  • SHA1

    46c4efbcc138840eaed8f5c26f5bb74ef5e79ce9

  • SHA256

    f7eaccc3f4b306591958f77a03564e042071a9d97f58fee8af3f646e097c43a6

  • SHA512

    3ada6a66b49509a9907b1f6b07c100b8506d983212a9448a5edfdcd052b03f51831f61dcce855675b525f3b4f6a63bc847343a172c90b60e1953614ed37b5cd9

  • SSDEEP

    3072:u3Qdvtycor+KTslwnm8QjxgvReWh0zzzd0pe1RdJzzzzrkzz6Pzf6lzz11MzU+JF:zvQcfoDZD/JJqc4xJ5nct

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7eaccc3f4b306591958f77a03564e042071a9d97f58fee8af3f646e097c43a6.exe
    "C:\Users\Admin\AppData\Local\Temp\f7eaccc3f4b306591958f77a03564e042071a9d97f58fee8af3f646e097c43a6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Users\Admin\AppData\Local\Temp\f7eaccc3f4b306591958f77a03564e042071a9d97f58fee8af3f646e097c43a6.exe
      C:\Users\Admin\AppData\Local\Temp\f7eaccc3f4b306591958f77a03564e042071a9d97f58fee8af3f646e097c43a6.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4864
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2768

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3212-136-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3212-139-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3212-140-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3212-141-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4712-132-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/4712-138-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB