Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/05/2023, 10:31
230522-mkghkaad6t 322/05/2023, 10:00
230522-l1xdaafe75 322/05/2023, 09:58
230522-lzv4tsfe72 322/05/2023, 09:57
230522-lyz2dsac5z 3Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22/05/2023, 09:57
General
-
Target
winHTTP.exe
-
Size
71KB
-
MD5
42350d934e950efe84485f138baea04a
-
SHA1
365e36db858e8d07fecf25a437386180b3a8e3ec
-
SHA256
cc3530b39340965530cb06d3cf7c100cc03542dbb988830b86490f0d26934fb3
-
SHA512
1406c9620c2a2bb2cd4d16f4968f24a0f494aed50f179c5f283f00e75c818d1ee1f35e0a5e81c2bfa415e9071980dfb03fdf801e4e87068b608eb8ddcfbd8471
-
SSDEEP
768:F6+27TkhNSsp9b2mNCK66vBWvBNLEaLt:FN2naSgkmUK66pWvBNYe
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 19 IoCs
-
Suspicious use of SendNotifyMessage 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\winHTTP.exe"C:\Users\Admin\AppData\Local\Temp\winHTTP.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB