Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/11/2022, 23:04

General

  • Target

    b2e9676872a44efc96894c89af1f725f645bbfcfe02be72bd9abe2a5f3c08fa4.exe

  • Size

    64KB

  • MD5

    3799963170fcfcfaa0018a518c0c8888

  • SHA1

    47e93d61871b92ef054b3938b8bc4155554e1cbd

  • SHA256

    b2e9676872a44efc96894c89af1f725f645bbfcfe02be72bd9abe2a5f3c08fa4

  • SHA512

    5919c6f155c14100458cd30eb74fbdbf3ec8edacdf855cabd2215006e544a3675fd360d940257185b9b9aef67547154002a2b3592337342f39a50969df6c26ea

  • SSDEEP

    1536:gUzp5/Ur2iwzWNyp7k1XXROdY25cJEJdTyhc01Z2RUG:dzp5TiwzWmkHv25l4c+a

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2e9676872a44efc96894c89af1f725f645bbfcfe02be72bd9abe2a5f3c08fa4.exe
    "C:\Users\Admin\AppData\Local\Temp\b2e9676872a44efc96894c89af1f725f645bbfcfe02be72bd9abe2a5f3c08fa4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:232
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4796

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/232-132-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/232-133-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/232-134-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/232-135-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/232-136-0x0000000002770000-0x00000000027BE000-memory.dmp

    Filesize

    312KB