Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
11/03/2023, 15:53
General
-
Target
a55c827c3285055010e1307a9785a5f4d403c3a857acadd1fded4a7de529db47.dll
-
Size
740KB
-
MD5
a2653075a9e69912f7ad570ff5589ff2
-
SHA1
345f7e813123599d59d564d7cf359f67b51fda6d
-
SHA256
a55c827c3285055010e1307a9785a5f4d403c3a857acadd1fded4a7de529db47
-
SHA512
2165d919d23257fc141d8df5f84ec4df18506226e22cd49e8c06d21dfd8d512036207d29c5ad7b14d54b276086119e9aeae6196b79d084fee9d7dcf82e9b4868
-
SSDEEP
12288:i+YE32Q8n9FgCBT4jh0rOcazvLbzTq4TYSyPKcaTuxfa:ivEwnfg04jgaXbzG4TYS8KcR
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a55c827c3285055010e1307a9785a5f4d403c3a857acadd1fded4a7de529db47.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Rkug.cmd1⤵
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\S8xM6E.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Xdlsydzchw" /TR C:\Windows\system32\wPA8K\cttune.exe /SC minute /MO 60 /RL highest1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Xdlsydzchw"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Xdlsydzchw"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Xdlsydzchw"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Xdlsydzchw"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Xdlsydzchw"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Xdlsydzchw"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744KB
MD5b635c49da55756e6ca69ecd710d4deba
SHA110c073317a6895a3209fbd98946a72d7ac332119
SHA256750ae5805b9176368ce904052105f19f506532d519588ef49f9cdf5d5ad2622e
SHA5128b9e5951a057d1c3d92c610f689a374e7c7144bfcf4d8baad6a65044e881b6abdb42591c9712e29f04cddd0106ca70d011c01e0ab5dd26abe3c5827749de84ec
-
Filesize
233B
MD5d09b46e749187796adc2b593a5c22c7c
SHA199a8043fcaf12f2bf5d46843104609137414e1f2
SHA256656de063b3163160c818d0bd59c1b966f5669d8caf5a473ff4b03b7afa3e34e5
SHA512ffe6da1cad8f0d695c97e2ec1f9935b94439375cc6344ea12877e79939f72d0be460ac6e9d459811481f0128e28a1f5b7dfac3c9c9abb70251a90915c23aa126
-
Filesize
193B
MD50704eb40106394cba2af80e53bda9bf3
SHA1b479f1bf8dfc65c92888ffbd6a7dbcc1c5334929
SHA256c3b130424f781ded477d0b98371c21c29111bec1a20a9d2095469fbb56d65b6d
SHA512ac36a97d58c6cb46226d2f94e637fcf82cd91842616e1271189ccf0d4c0eae9f55ea70eb4969e838e25e22066de59cf882cae41ed2b27d8626a0bbbf71ba7bc7
-
Filesize
744KB
MD5e572cb705f2a5ea79175fa2c3a82f36b
SHA1a82ec9d6870030d5bd555195d8c9548d4bbd3788
SHA256012db8b89a46e167169a382cc4aa43c7b601bf6efbf4bb12ea0c4e92fad3dc49
SHA512cf13694ce9fa2d633b9b72c95eddbc35b18fafb9f5de6f0245f0472e1d3d91ab6fa4059d2263918bad3940781721d702592b8ad13ad290d9e8decd3fa31301e0
-
Filesize
883B
MD56556e195285139c9c449818cf7288358
SHA1b3c7494ab070e2ec16872f525c68b8f509ea20a9
SHA25693ac3d3653bb3fcb02dea9b982a1f2d9944cdebaf34f108e5db779c9b9d2e307
SHA512643a92e0e70cb78860f8ef03e576edecd5a23678b0ebfbbe43e682a08ea1f8c088eba4cf983fc40a9b1e88e4c00d2d19062ae9b98faa7a17461315844d277df4
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
4KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
32KB
-
Filesize
740KB