Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 04:11

General

  • Target

    66d954fb5cd0b19c79cc4d6cdcff5f068275c63a2ffc78ddcae69da3239b42c9.exe

  • Size

    280KB

  • MD5

    199c3aa4d05ceb82098c885a88793959

  • SHA1

    993835f18539e58ea6de7b2fe0ec08dd99f7f04e

  • SHA256

    66d954fb5cd0b19c79cc4d6cdcff5f068275c63a2ffc78ddcae69da3239b42c9

  • SHA512

    3dbaf8ae63c67ab502c8568c8f3e53bf1a59246c6ec261022b4ed36af240568b970587431f2383b1abf83af0580aa334445250bb5a0132d11a59ae426eaacb20

  • SSDEEP

    6144:KqnUMBH2gzuBu02UiO0Qp9Gr9SKqMYgpwp:z/DzuBD20b3GoWp

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66d954fb5cd0b19c79cc4d6cdcff5f068275c63a2ffc78ddcae69da3239b42c9.exe
    "C:\Users\Admin\AppData\Local\Temp\66d954fb5cd0b19c79cc4d6cdcff5f068275c63a2ffc78ddcae69da3239b42c9.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3916-132-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/3916-133-0x0000000000400000-0x00000000004BF000-memory.dmp

    Filesize

    764KB

  • memory/3916-134-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/3916-135-0x0000000002300000-0x00000000023B2000-memory.dmp

    Filesize

    712KB

  • memory/3916-136-0x0000000002570000-0x0000000002628000-memory.dmp

    Filesize

    736KB

  • memory/3916-137-0x0000000000400000-0x00000000004BF000-memory.dmp

    Filesize

    764KB

  • memory/3916-138-0x0000000002570000-0x0000000002628000-memory.dmp

    Filesize

    736KB