Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

9e10f8d939...39.exe

windows7-x64

6

9e10f8d939...39.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    60s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 16:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9e10f8d93975f4972d603a4039fbecfd32c60506809dbfafdec6225f7fc74f39.exe

  • Size

    148KB

  • MD5

    57e0ba18728a3b9900b2b55facf259b8

  • SHA1

    240f802eff96bd95f648a4526ed9c97d3096a010

  • SHA256

    9e10f8d93975f4972d603a4039fbecfd32c60506809dbfafdec6225f7fc74f39

  • SHA512

    41b38a6a738f65beebe4b85194c4c866259938d7f889dc2ff8462f88b216614184282257c5ca9b3a719eebda46afcd75a47c52a1af096d01b8e3ea8b9b948ef4

  • SSDEEP

    3072:xnSJbvkX6wqkqk+BQAJyIDKeKy9LBIJGp7A4H7UESq7xKL+sfa:8xM+LZQdIDx9LSr4bU6AL+sfa

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e10f8d93975f4972d603a4039fbecfd32c60506809dbfafdec6225f7fc74f39.exe
    "C:\Users\Admin\AppData\Local\Temp\9e10f8d93975f4972d603a4039fbecfd32c60506809dbfafdec6225f7fc74f39.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:1388

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1388-132-0x0000000002500000-0x0000000002522000-memory.dmp

    Filesize

    136KB

    Download