Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-es -
resource tags
arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
14/02/2023, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
ReduceMemory.exe
Resource
win7-20220812-es
windows7-x64
5 signatures
30 seconds
Behavioral task
behavioral2
Sample
ReduceMemory.exe
Resource
win10v2004-20220812-es
windows10-2004-x64
8 signatures
30 seconds
General
-
Target
ReduceMemory.exe
-
Size
776KB
-
MD5
0d626331715cc35aa377a8503f85c92a
-
SHA1
26aad89595f00068151d3676297ceec394e718af
-
SHA256
3e541100c869dba06ee62252a9661e5a06c2e685a7ddd5288ea1358703412385
-
SHA512
6dcdc39672dd00873c55753ba02ad05dc61ef028a4de385d5af38f30c4959342ac25f0ae936a19fb29100a49ab379f16f5288578434e1aea83b03e596d999996
-
SSDEEP
12288:UaWzgMg7v3qnCiHErQohh0F4aCJ8lny7QSpJJ9vZ+dAy2s:LaHMv6C7rjCny7QQx+Is
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2180 created 4504 2180 svchost.exe 79 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4504 ReduceMemory.exe 4504 ReduceMemory.exe 4504 ReduceMemory.exe 4504 ReduceMemory.exe 4504 ReduceMemory.exe 4504 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 ReduceMemory.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4504 ReduceMemory.exe Token: SeAssignPrimaryTokenPrivilege 4504 ReduceMemory.exe Token: SeIncreaseQuotaPrivilege 4504 ReduceMemory.exe Token: 0 4504 ReduceMemory.exe Token: SeTcbPrivilege 2180 svchost.exe Token: SeTcbPrivilege 2180 svchost.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe -
Suspicious use of SendNotifyMessage 47 IoCs
pid Process 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe 2172 ReduceMemory.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2172 2180 svchost.exe 81 PID 2180 wrote to memory of 2172 2180 svchost.exe 81 PID 2180 wrote to memory of 2172 2180 svchost.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\ReduceMemory.exe"C:\Users\Admin\AppData\Local\Temp\ReduceMemory.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\ReduceMemory.exeC:\Users\Admin\AppData\Local\Temp\ReduceMemory.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2172
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD592a4c11a098f9a59de58a9230ea75b13
SHA18fa718c81ef1efaeb9537430a8490e194e22f54f
SHA256b7308dcc24351f9e038cb7e8a37eea7a7e2128bb3fad7ca8758f40eb8c8f26cc
SHA5122564f1a7192da709099ae324020bfe71196b9c547eb9192b53aba0e5d44ed18422748df2462a153f4fca2ecf77fda90aa502c4c8368f4e2b3cd27526a1a51dab