Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
01/12/2022, 02:42
General
-
Target
7feafbb48b8f2053f57994033770a4d4b0f34ef4a368a99667c644d8492597cc.exe
-
Size
233KB
-
MD5
6b46424f311e8788cbe403da7fc4971e
-
SHA1
35dc2391baf98941fc1df37864a36f141fd42e16
-
SHA256
7feafbb48b8f2053f57994033770a4d4b0f34ef4a368a99667c644d8492597cc
-
SHA512
75db704d38909b708dce4ab3570af4e37c81038cf76c078469d210452c1f58dd46d11239b4b7142bdfdcd2d3103492ff8b8980278e34a0f2b0325234151bdc9c
-
SSDEEP
6144:zSbxtD9NyTRduYTF8Lt5slJARjzy0AjgTz:OxHNy9TSbLRK5
Score
8/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7feafbb48b8f2053f57994033770a4d4b0f34ef4a368a99667c644d8492597cc.exe"C:\Users\Admin\AppData\Local\Temp\7feafbb48b8f2053f57994033770a4d4b0f34ef4a368a99667c644d8492597cc.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB