Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
226s -
max time network
287s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
10/02/2023, 15:07
General
-
Target
entry001/CounterTool.exe
-
Size
32KB
-
MD5
93822650a6ce5e6e7625418360ecc935
-
SHA1
b58bf01e0ce32cda243c2491e5fd8a7a6c3ca02c
-
SHA256
ec84be66200d09941945109056e1ead8c8dc91f37de9e4e66c4f3539c4a273c5
-
SHA512
3abb336e3816937130ca57dc4feed8e322d6ac04503302ef9158efb70dc00de4f525f7ff3c02bdb28eab5b2dc2cb64aca1af5596822639213d13dc064b78369b
-
SSDEEP
768:LygDnGgojdLxOQPpMtwOuPszMEZIQR1O:L8Ct4GM+U
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\entry001\CounterTool.exe"C:\Users\Admin\AppData\Local\Temp\entry001\CounterTool.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage