Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07/03/2023, 22:37
Static task
static1
Behavioral task
behavioral1
Sample
MegaDownloader.exe
Resource
win7-20230220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
MegaDownloader.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
MegaDownloader.exe
-
Size
2.1MB
-
MD5
02d50582f3216d59744f80b407ba0b70
-
SHA1
6b1124e414f5151aae7f8fe515ceea019d276e89
-
SHA256
dd2e64e27b2a982fd08365c37a26953c28fd386ec075c47cc05101c2b2660d2b
-
SHA512
5b2078704f0c8d807cc8132ec343824288af900fd7441626ff7d0d59c4208a4ba3e287dc4d2d113abfb605f7392a80c50697c8f8ebaa21e1e4dcc8c40e75996c
-
SSDEEP
49152:lRRRcFpfwKDNhjWlkd1C8rzN5BEH8dTpn5gP1YWmaYHNS:MpfNjWlg4WXKcT5gP1LkNS
Score
1/10
Malware Config
Signatures
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaDownloader.exe\" %1" MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega MegaDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\ = "URL: mega Protocol" MegaDownloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mega\URL Protocol MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open\command MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell MegaDownloader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mega\shell\open MegaDownloader.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 912 MegaDownloader.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe 912 MegaDownloader.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 912 MegaDownloader.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 912 MegaDownloader.exe Token: 33 912 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 912 MegaDownloader.exe Token: 33 912 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 912 MegaDownloader.exe Token: 33 912 MegaDownloader.exe Token: SeIncBasePriorityPrivilege 912 MegaDownloader.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 912 MegaDownloader.exe 912 MegaDownloader.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 912 MegaDownloader.exe 912 MegaDownloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MegaDownloader.exe"C:\Users\Admin\AppData\Local\Temp\MegaDownloader.exe"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:912
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1764