Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2023, 14:26

General

  • Target

    tmp.exe

  • Size

    631KB

  • MD5

    145186629cf226ca987625b55ed9e9c7

  • SHA1

    8203cfc6a8dc0ffae22167e0735a6e9169fe279d

  • SHA256

    65209a1c9e0c0c1d5cfa80df4ff1ba6d1742e1b5ac8a4e32b38e49749c312cdd

  • SHA512

    57e8a81cce89bfd81610f246e7b2afb92cff1848d3a67cbaf2910c7925208262458fc37232cbcf8b26017911c923a1acd7841acb29ac9c0915bb0a13217ea5ce

  • SSDEEP

    12288:6Lo/Jm2IhImMeg+gk4GEcMRwAciycSHKW3:6LwmZMz3GuRwAcK

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      PID:3252

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3252-139-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/3252-141-0x0000000005B00000-0x0000000005B0A000-memory.dmp

    Filesize

    40KB

  • memory/3252-142-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

    Filesize

    64KB

  • memory/3252-143-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

    Filesize

    64KB

  • memory/3960-133-0x0000000000200000-0x00000000002A4000-memory.dmp

    Filesize

    656KB

  • memory/3960-134-0x0000000002790000-0x00000000027A0000-memory.dmp

    Filesize

    64KB

  • memory/3960-135-0x0000000004DD0000-0x0000000004E36000-memory.dmp

    Filesize

    408KB

  • memory/3960-136-0x00000000363C0000-0x0000000036452000-memory.dmp

    Filesize

    584KB

  • memory/3960-137-0x0000000036A10000-0x0000000036FB4000-memory.dmp

    Filesize

    5.6MB