Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
19/05/2023, 05:44
General
-
Target
4th Hire Soa Remittance.exe
-
Size
617KB
-
MD5
854e22aa8f838bc5638f401e1d6faaf0
-
SHA1
95792a0d5c497777fe283f5b9eb74f14e2e407ce
-
SHA256
2bfe16100af653d012b5b833cf2ed6431ae1ca9660fab081679f92da34fb5f57
-
SHA512
8b2238ab1c74794fcbf23241475c35fbecd5482aa48d49f0e1cbd706656d0997b3aa4b4eb3ebf47eca56663cf57527d7d59c85740adf748917366315376bdcfa
-
SSDEEP
12288:eopnFv5yczago+/3FIqbipq/HQzIbPKgObpb5LYU/gD+jU/ecZBAYq4:ZVV1o+/e4jHQzQlObpFLYV+jJWBf
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4th Hire Soa Remittance.exe"C:\Users\Admin\AppData\Local\Temp\4th Hire Soa Remittance.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4th Hire Soa Remittance.exe"C:\Users\Admin\AppData\Local\Temp\4th Hire Soa Remittance.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4th Hire Soa Remittance.exe"C:\Users\Admin\AppData\Local\Temp\4th Hire Soa Remittance.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB