Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    208s
  • max time network
    260s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2023, 04:26

General

  • Target

    PvZ Road Trip.exe

  • Size

    936KB

  • MD5

    a99bb2d4387ad643ffc9a2d8d3a65b0d

  • SHA1

    c4d9ccfb1a1a45a66cf7432d6a2cb80fae74580a

  • SHA256

    9a884c29643a5eeef591855bebb1f687222fddbf46b76d225231bdecce9eb1aa

  • SHA512

    cde8196b92508c2aafdf6e0225e8a4acfd3c8e289d8fa9e4b0a551973e165f426fde002b1389dcd61201e65bcb7087a24d1fd4957792428689149b7c4c51b2c8

  • SSDEEP

    12288:g6LMFY+X+LJPgawU31s1YyN6HNAaWz+yFvbfZ2XhfDf+1G:g6LMdlCyNyA1FvjZ2I1G

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PvZ Road Trip.exe
    "C:\Users\Admin\AppData\Local\Temp\PvZ Road Trip.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4424
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x33c 0x3fc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\MMFApplications\PvZRT.Ini

    Filesize

    212B

    MD5

    2a301390e6e75b04082c02cfafc409cf

    SHA1

    09b55028c765f818c3a44e7cec18a948dc338c96

    SHA256

    9d8461db6643a4a59b7f0420156b8cea7809cde30268032363cebe5726d23fa2

    SHA512

    4f6f1f278c41cbfca4c3ff8cc8139d521248510a2c31a24f51cec8db3c0fd901b0b28bbf8c02b447e903864afb76e5ac8633df486831e947b0997be89bedfb82

  • C:\Users\Admin\AppData\Roaming\MMFApplications\PvZRT.Ini

    Filesize

    223B

    MD5

    448b04833bce568dab5b9e10bdd68938

    SHA1

    f8c1a9e67a6b9934f590854e23a21c73497a31e2

    SHA256

    d0c2e68e8bb73868bddba164345ff3c84a78955b6cf609ccb5d50cf66858e3a1

    SHA512

    cdc0db649429431b20303e42a0fe958900f23242e29c5898f008186f28ef0acfad9b609b82400814340242a33383b99dec5e408b09d08310107d918f7167cac5

  • memory/4424-133-0x0000000002700000-0x000000000270B000-memory.dmp

    Filesize

    44KB

  • memory/4424-134-0x0000000002760000-0x00000000027A9000-memory.dmp

    Filesize

    292KB

  • memory/4424-136-0x00000000027B0000-0x0000000002809000-memory.dmp

    Filesize

    356KB

  • memory/4424-138-0x0000000002860000-0x0000000002872000-memory.dmp

    Filesize

    72KB

  • memory/4424-139-0x0000000002890000-0x00000000028B2000-memory.dmp

    Filesize

    136KB

  • memory/4424-141-0x00000000028D0000-0x00000000028EB000-memory.dmp

    Filesize

    108KB

  • memory/4424-143-0x0000000002A80000-0x0000000002AA4000-memory.dmp

    Filesize

    144KB