Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 05:01

General

  • Target

    c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e.exe

  • Size

    281KB

  • MD5

    c480f54f732054b056ab3f58b2ac8849

  • SHA1

    7d6dcdd28f4d81accabdbf5b47b89b6466066404

  • SHA256

    c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e

  • SHA512

    3d179f7a16b172b3fd39bb1895880e94853805e7d36ca251539016e22f82877b1e0cfc780f73149c545422230fc4cce76242371afb7b0f9fff8855574c48e770

  • SSDEEP

    6144:CAjYIKd4yigl6vffQGe1gGoSFInOl4Dtb73:C6XdffQaFVn+w3

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e.exe
    "C:\Users\Admin\AppData\Local\Temp\c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4284

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4284-132-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/4284-133-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/4284-134-0x0000000002680000-0x0000000002732000-memory.dmp

    Filesize

    712KB

  • memory/4284-135-0x0000000002840000-0x00000000028F8000-memory.dmp

    Filesize

    736KB

  • memory/4284-136-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/4284-137-0x0000000002840000-0x00000000028F8000-memory.dmp

    Filesize

    736KB