Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    189s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 08:56

General

  • Target

    af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab.exe

  • Size

    250KB

  • MD5

    fb842474b5529980e8fdfa01f647f87a

  • SHA1

    dbecd4ecf444b940b965393b7d03df7e7527da11

  • SHA256

    af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab

  • SHA512

    c7af6bd000bbdce11be7daff650db7d2de7930c852908111cc6a9dd7d5e730d75b860b5b1514efa72d0a008ec3ff04127476b67fdf8688e9774b55d26fed9eaf

  • SSDEEP

    6144:aZ/4UHB0CnKk/T7J6bdULh3VvKsO5GTHYjlzIS:sKk/TCdULxViZ5GrYjlzx

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab.exe
    "C:\Users\Admin\AppData\Local\Temp\af6e862a05210c02035abc3109aca724c232b865a79b700fcb72c51b9b8a6dab.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/444-132-0x0000000002350000-0x0000000002398000-memory.dmp

    Filesize

    288KB

  • memory/444-133-0x0000000000400000-0x0000000000525000-memory.dmp

    Filesize

    1.1MB

  • memory/444-134-0x0000000002350000-0x0000000002398000-memory.dmp

    Filesize

    288KB

  • memory/444-135-0x0000000002480000-0x0000000002532000-memory.dmp

    Filesize

    712KB

  • memory/444-136-0x0000000002A70000-0x0000000002B28000-memory.dmp

    Filesize

    736KB

  • memory/444-137-0x0000000000400000-0x0000000000525000-memory.dmp

    Filesize

    1.1MB

  • memory/444-138-0x0000000002A70000-0x0000000002B28000-memory.dmp

    Filesize

    736KB