Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06/12/2022, 01:01
General
-
Target
b58d237f1b976ee2817299579a19093f0a8821b93a5f4153aff38d9576a73594.exe
-
Size
188KB
-
MD5
3656388deb6f61e1aea2290b3b9c015b
-
SHA1
c815acce3c27fe1189a6af3f0e4743b78505e6e6
-
SHA256
b58d237f1b976ee2817299579a19093f0a8821b93a5f4153aff38d9576a73594
-
SHA512
7a91ca90143cc0722f1436e53ecad373c558e52345424f35ff24ffa071a8f83660186aa0a9febc73deb0a493452e8d920e850243c6ec6c8b842567352a7b4a17
-
SSDEEP
3072:BO0pVZsOEIeSin+D7mlWvkIe7eTvRajG04IY3bmEW0zAt2SvYB9EF:t2OFeSYm7mlWMIeazYpfYrc0PtB9
Score
8/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\b58d237f1b976ee2817299579a19093f0a8821b93a5f4153aff38d9576a73594.exe"C:\Users\Admin\AppData\Local\Temp\b58d237f1b976ee2817299579a19093f0a8821b93a5f4153aff38d9576a73594.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB