Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe
Resource
win10v2004-20221111-en
General
-
Target
f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe
-
Size
148KB
-
MD5
3c4e60d6c1d695e9d8a7401b4a134818
-
SHA1
3bed45819c9e0eb82ffe2f76a7cbcd9d7506e8d4
-
SHA256
f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a
-
SHA512
f47db7bd24add075e262470a2de0ebe23eea8554a9d85becf876e94bbd3909eb1af9adbe0561309b88312858b9ca8431434c35772f9cf57c2d755e61c214b254
-
SSDEEP
3072:H6LGuAisKMY+lJeLbF8CqkvriuiRjs8pb3lQ4m5:HWOYtjvrhsy9
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\Initialize MicroSystem Log.job f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe File created C:\Windows\Tasks\Initialize MicroSystem Log.job f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Scheduler for shopsinnayo f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Scheduler for shopsinnayo\sch_set = "1" f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1272 f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe 4584 f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe"C:\Users\Admin\AppData\Local\Temp\f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1272
-
C:\Users\Admin\AppData\Local\Temp\f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exeC:\Users\Admin\AppData\Local\Temp\f684bea5e3139380328994a6450560851aef2be0037f59d197f6703b6d50441a.exe1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4584
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378B
MD553c6d57b0482baf59f36ae6fef688388
SHA13f8ac6aa8aff5a4880b32e15940e85c6d82a50b9
SHA25656787924c01a13ba28d2bcadebd1cd1544d042d30a6213a4e3dce6376edde34a
SHA51241e1f20ed8cd2699742201452751f101a61c774867931521b63bc5d4dd5cd9b7447a65a1c7c6359760f1ce9b7b30af28d79a24a3f5b409341d9ef7c394c63f48