Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
22s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
16/02/2023, 20:35
General
-
Target
73861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065.exe
-
Size
4.1MB
-
MD5
0ae581f2f3816bf4c3d20e7df2168063
-
SHA1
240dec76d9030b26f6726f55dd0f3a7742856b0c
-
SHA256
73861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065
-
SHA512
ae19de646d0d7222122bc81eee906ff638908f966495e4636350760af6df94a8a15f4ef0436734b071b4f46fc15db0249c135378f555c457723ba513fb082840
-
SSDEEP
98304:zsnt0cW1roMdpiMR5qZNa/e4pUJ0n4A9ahoWP:z/cCrXpJ5qKm4pUan4ApWP
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\73861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065.exe"C:\Users\Admin\AppData\Local\Temp\73861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\73861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065.exe"C:\Users\Admin\AppData\Local\Temp\73861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065.exe"2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD50ae581f2f3816bf4c3d20e7df2168063
SHA1240dec76d9030b26f6726f55dd0f3a7742856b0c
SHA25673861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065
SHA512ae19de646d0d7222122bc81eee906ff638908f966495e4636350760af6df94a8a15f4ef0436734b071b4f46fc15db0249c135378f555c457723ba513fb082840
-
Filesize
4.1MB
MD50ae581f2f3816bf4c3d20e7df2168063
SHA1240dec76d9030b26f6726f55dd0f3a7742856b0c
SHA25673861d0ac046dfdaf51e29552eee46e0e25efc03e1b8f856d252d21da6a00065
SHA512ae19de646d0d7222122bc81eee906ff638908f966495e4636350760af6df94a8a15f4ef0436734b071b4f46fc15db0249c135378f555c457723ba513fb082840
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
3.9MB
-
Filesize
8.5MB
-
Filesize
8.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
8.6MB
-
Filesize
3.9MB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
3.9MB
-
Filesize
8.6MB