Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 06:14

General

  • Target

    afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe

  • Size

    283KB

  • MD5

    13ff7125821bc90d9d22ac62233bea0e

  • SHA1

    9c868edd4a9684cbd367527403b07c9654027c89

  • SHA256

    afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf

  • SHA512

    aba0d2d3af8ee3e0d94b5c8bb6399ea33fe4127ca770b3fbd86f5974c6cc2a0e4804424aae198a59d4a9d3eaf4d34ba4033e9a50ddfc8eb520def0153b16899f

  • SSDEEP

    6144:/w6JOerGp2aPeiyx+/Hqyo3ia/keIJSkH364n8LQTj3Fv0B2fJLY4:/wurYPex+/2rXI5XxBj3GMfJ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe
    "C:\Users\Admin\AppData\Local\Temp\afe957105ece51dadd9e6735a86f98145a7b33b2c0682b9c2a0408d1eb5219cf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfsF968.tmp

    Filesize

    496KB

    MD5

    93fde31f598bbfb7b0822648d4a83889

    SHA1

    9b7194bbdcee2ed5ee95769a79e44dcb1c848944

    SHA256

    2bcf933a8542f0df471a459e3a37408c1209fbe367bcd738e7d7a1700a36f983

    SHA512

    ee6ba0aafe8b2830ff5f8986be652f097f65632252abd55abefa4fd2e4269afdd62387ea5faff110da77463418b2e4406d5a3dc1ac7c884b7f676bff4b4e07cf

  • C:\Users\Admin\AppData\Local\Temp\dfsF968.tmp

    Filesize

    496KB

    MD5

    93fde31f598bbfb7b0822648d4a83889

    SHA1

    9b7194bbdcee2ed5ee95769a79e44dcb1c848944

    SHA256

    2bcf933a8542f0df471a459e3a37408c1209fbe367bcd738e7d7a1700a36f983

    SHA512

    ee6ba0aafe8b2830ff5f8986be652f097f65632252abd55abefa4fd2e4269afdd62387ea5faff110da77463418b2e4406d5a3dc1ac7c884b7f676bff4b4e07cf

  • memory/2032-132-0x00000000001C0000-0x000000000027A000-memory.dmp

    Filesize

    744KB

  • memory/2032-133-0x0000000000F30000-0x0000000000F33000-memory.dmp

    Filesize

    12KB

  • memory/2032-136-0x00000000052A0000-0x0000000005322000-memory.dmp

    Filesize

    520KB

  • memory/2032-137-0x0000000005DD0000-0x0000000006374000-memory.dmp

    Filesize

    5.6MB

  • memory/2032-138-0x0000000005820000-0x00000000058B2000-memory.dmp

    Filesize

    584KB

  • memory/2032-139-0x00000000057E0000-0x00000000057EA000-memory.dmp

    Filesize

    40KB

  • memory/2032-140-0x0000000009930000-0x0000000009996000-memory.dmp

    Filesize

    408KB

  • memory/2032-141-0x0000000000F30000-0x0000000000F33000-memory.dmp

    Filesize

    12KB

  • memory/2032-142-0x000000000EB20000-0x000000000F2C6000-memory.dmp

    Filesize

    7.6MB