Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2023, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe
Resource
win10v2004-20220812-en
General
-
Target
de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe
-
Size
5.3MB
-
MD5
96d961782f91eddbbd62bf67559929f2
-
SHA1
c2f8cacf43a8013a2843501c8fe9dd2c671040b8
-
SHA256
de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a
-
SHA512
fa68247e33dde188b39d1e04d537c392baeddf9afd2918242ba2d717ac762524fec838c080e70c0ef8d5e525ef47056f24c19c6db8d635904bb8e63cef276282
-
SSDEEP
49152:UopwyFWlT+c3TTQVa0DqeyG0uAR/5BTnV3VEgHztu+thX44ifGJtSqeQLgza6BD9:VrsT+PVaJGq5VzArOSqeDalc6d
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 5048 de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe -
resource yara_rule behavioral2/memory/5048-133-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-135-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-134-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-137-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-139-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-141-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-143-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-145-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-147-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-149-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-151-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-153-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-155-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-157-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-159-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-161-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-163-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-165-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-167-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-169-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-171-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-173-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-175-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/5048-176-0x0000000010000000-0x000000001003F000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeCreateGlobalPrivilege 5048 de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5048 de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe 5048 de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe 5048 de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe"C:\Users\Admin\AppData\Local\Temp\de582399d812568dd01742e9242ad2d2540808659eec0ee5bc0dc5efb0eaff4a.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5048
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.4MB
MD58b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA256982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
SHA5129d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a