Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    176s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 22:24

General

  • Target

    802c73e7f2534a1b911d01f5896ff79aff52b4e991eae2bdb9d6829c45b73070.exe

  • Size

    1.9MB

  • MD5

    7d83f87ffdb56e9d132b516eaa4cbedc

  • SHA1

    71a2e97e0c6c0afe9adcb255f8412c4bb665a0a0

  • SHA256

    802c73e7f2534a1b911d01f5896ff79aff52b4e991eae2bdb9d6829c45b73070

  • SHA512

    2b4bd229496649b087ad5dbd9125ede3994ea1e6503253cc6b0f1105094f27c8aaf3518dd1abbd6ef77b189fe9018abb7aa119a9cccf3577dd2a48d37ba8a5a8

  • SSDEEP

    49152:aVAWmAILXdbhljDasY6DwOBfrnvV7UeWt2bExrl5VeR:aagILd9YiwOBpIeW9rlXeR

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\802c73e7f2534a1b911d01f5896ff79aff52b4e991eae2bdb9d6829c45b73070.exe
    "C:\Users\Admin\AppData\Local\Temp\802c73e7f2534a1b911d01f5896ff79aff52b4e991eae2bdb9d6829c45b73070.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4288-132-0x0000000000390000-0x0000000000480000-memory.dmp

    Filesize

    960KB

  • memory/4288-133-0x0000000002BE0000-0x0000000002C1D000-memory.dmp

    Filesize

    244KB

  • memory/4288-134-0x0000000000390000-0x0000000000480000-memory.dmp

    Filesize

    960KB

  • memory/4288-135-0x0000000000390000-0x0000000000480000-memory.dmp

    Filesize

    960KB

  • memory/4288-136-0x0000000000390000-0x0000000000480000-memory.dmp

    Filesize

    960KB

  • memory/4288-137-0x0000000002BE0000-0x0000000002C1D000-memory.dmp

    Filesize

    244KB

  • memory/4288-138-0x0000000000390000-0x0000000000480000-memory.dmp

    Filesize

    960KB

  • memory/4288-139-0x0000000076DB0000-0x0000000076FC5000-memory.dmp

    Filesize

    2.1MB

  • memory/4288-140-0x0000000074C20000-0x00000000751D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4288-141-0x0000000076420000-0x00000000769D3000-memory.dmp

    Filesize

    5.7MB

  • memory/4288-142-0x0000000074C20000-0x00000000751D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4288-143-0x00000000770B0000-0x0000000077331000-memory.dmp

    Filesize

    2.5MB

  • memory/4288-144-0x0000000076A10000-0x0000000076AF3000-memory.dmp

    Filesize

    908KB

  • memory/4288-145-0x0000000073940000-0x000000007399B000-memory.dmp

    Filesize

    364KB

  • memory/4288-146-0x0000000074C20000-0x00000000751D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4288-147-0x0000000073110000-0x000000007312E000-memory.dmp

    Filesize

    120KB

  • memory/4288-148-0x0000000073120000-0x0000000073128000-memory.dmp

    Filesize

    32KB

  • memory/4288-149-0x00000000730F0000-0x00000000730F8000-memory.dmp

    Filesize

    32KB

  • memory/4288-150-0x0000000072DE0000-0x00000000730BE000-memory.dmp

    Filesize

    2.9MB

  • memory/4288-151-0x0000000072D50000-0x0000000072DDD000-memory.dmp

    Filesize

    564KB