Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    187s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2022, 03:46

General

  • Target

    cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe

  • Size

    148KB

  • MD5

    288890e2c2890392a3c6db6ab9c7c54b

  • SHA1

    7816b571ada479c1df364b6db6fc566b81e36d89

  • SHA256

    cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb

  • SHA512

    93cff4a2b66c8ce9f7404892e9ffea29423dda6648b23d5974df986f2bd3bc5b545c65028e20fda3bc376b3e322caa549b4aeaf96272237e9a25d91d1c9f6e7d

  • SSDEEP

    3072:fPNIIS1JrpdvQD8CbCF/Fp2zrcNmSZNMBeRZ9aZUXcX:fW5tdvhCbCFtp2zrTSzMKZ9JXcX

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
    "C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
      "C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4188
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2084

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    7e145496e26bad88f2e9ac990b743c01

    SHA1

    57b9be66121d46af3fd063bc14f75f8545ea3992

    SHA256

    69d1f2f9dbdfa75dd0cd9c482609c9d0bae3de5432b7ada8998588830a534da5

    SHA512

    128958b60d53aedb2f4d764b18ccc8f0ea2436ec384262b1d97dc5a940909e3e1a5bd29b9e4609dbda5057a8e5292655c786e3b8f0dff4d446f5cd987b87434f

  • memory/1268-132-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/1268-133-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/1636-137-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1636-139-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1636-140-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1636-141-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1636-142-0x0000000000700000-0x000000000074E000-memory.dmp

    Filesize

    312KB

  • memory/1636-143-0x0000000000700000-0x000000000074E000-memory.dmp

    Filesize

    312KB

  • memory/1636-144-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB