Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    86s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2023, 14:13

General

  • Target

    Fund-Notifications-545pdf.exe

  • Size

    5.2MB

  • MD5

    68aa4f34a072419ae905d1cde1f95657

  • SHA1

    eed899d2ae028a58bbb8bfb27c18282c26b2acee

  • SHA256

    91317464f677d1408e609d2296203b84cebed70ebc9aec92b51734c52db5bb32

  • SHA512

    bd28fff606bb2d9efeb0da9b512cd892755ec74759bda8c9d7ca20ddf6a502c277dcbe02a64c898bd52b983884b67891976611f6abf57393c6a18a055171ccd9

  • SSDEEP

    24576:aSKuD4f2v9Y0Z8jmzN6epIou2dua0acpXXc0GoK1D4f2v9Y0Z8jmzN6epIou2duw:a2cIZ8h4OsoU1cIZ8h4OsoU

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fund-Notifications-545pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Fund-Notifications-545pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      PID:1148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1148-166-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-162-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-136-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-137-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-138-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

    Filesize

    64KB

  • memory/1148-140-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-142-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-144-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-146-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-148-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-150-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-152-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-154-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-158-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-160-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-156-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-168-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-164-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-134-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/1148-2092-0x0000000005A20000-0x0000000005A2A000-memory.dmp

    Filesize

    40KB

  • memory/1148-176-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-172-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-174-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-170-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-178-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-180-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-182-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-184-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-186-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-188-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-190-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-192-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-194-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-196-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-198-0x0000000004F10000-0x0000000004FD7000-memory.dmp

    Filesize

    796KB

  • memory/1148-2089-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

    Filesize

    64KB

  • memory/1148-2090-0x0000000005F00000-0x00000000064A4000-memory.dmp

    Filesize

    5.6MB

  • memory/1148-2091-0x0000000005A50000-0x0000000005AE2000-memory.dmp

    Filesize

    584KB

  • memory/2660-133-0x0000000000800000-0x0000000000D44000-memory.dmp

    Filesize

    5.3MB