Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
01/12/2022, 01:08
General
-
Target
93527b52a1094ae6658f64cff70c70e3cdb9d0b80912d55b0d93da912dc4e642.exe
-
Size
339KB
-
MD5
ddbea14aa39e9d30074e7ebfc6a95f55
-
SHA1
1f2a71d36d059040153d281969b07f9364d5c2b4
-
SHA256
93527b52a1094ae6658f64cff70c70e3cdb9d0b80912d55b0d93da912dc4e642
-
SHA512
a49d755c24d704bf0aef0bb85160a6b8c5cfaf0045afc31560ec5fa82ae502df2a8f3410b1ac33b274343e5d7fb0f3b41dd9ffde23de30024863a687cf0910cf
-
SSDEEP
6144:6RgJZRbMK79GfHiEQF9BcvT/9BwviZ27vyQOxcUkripfpf2n1MArJ:iSMmGfLQF9Sr/9iiZBQOqXepfpf2n1M4
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93527b52a1094ae6658f64cff70c70e3cdb9d0b80912d55b0d93da912dc4e642.exe"C:\Users\Admin\AppData\Local\Temp\93527b52a1094ae6658f64cff70c70e3cdb9d0b80912d55b0d93da912dc4e642.exe"1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\ApEbreAeEdvn.exeC:\ProgramData\ApEbreAeEdvn.exe2⤵
- Executes dropped EXE
- Maps connected drives based on registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD5ddbea14aa39e9d30074e7ebfc6a95f55
SHA11f2a71d36d059040153d281969b07f9364d5c2b4
SHA25693527b52a1094ae6658f64cff70c70e3cdb9d0b80912d55b0d93da912dc4e642
SHA512a49d755c24d704bf0aef0bb85160a6b8c5cfaf0045afc31560ec5fa82ae502df2a8f3410b1ac33b274343e5d7fb0f3b41dd9ffde23de30024863a687cf0910cf
-
Filesize
339KB
MD5ddbea14aa39e9d30074e7ebfc6a95f55
SHA11f2a71d36d059040153d281969b07f9364d5c2b4
SHA25693527b52a1094ae6658f64cff70c70e3cdb9d0b80912d55b0d93da912dc4e642
SHA512a49d755c24d704bf0aef0bb85160a6b8c5cfaf0045afc31560ec5fa82ae502df2a8f3410b1ac33b274343e5d7fb0f3b41dd9ffde23de30024863a687cf0910cf
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
212KB
-
Filesize
448KB
-
Filesize
448KB