Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
30s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
26/05/2023, 16:15
General
-
Target
autorun.exe
-
Size
76.0MB
-
MD5
f2deeaaf4ecd6e5cee078f5c69acede1
-
SHA1
d20d9180d6b13ab7097eb563c3f0b9f165baf8f8
-
SHA256
2b4a2214630e7122a0f06815c5f32f9f15d31c89b7f2a54fb6e6d41c204f270e
-
SHA512
98d7260dacb927121e87e6e3b32db8d2222f3f1ffa64991de63c7dfbee2ab90134ebef2f292cd5fca45f62ca7701056add2d017700bfa0968aa8b5b6d5e7bb18
-
SSDEEP
1572864:5qYbrm28QlTmPG4L2nFGnnDLRqBda2cuKXSX2de43NWYkjRZPvToKW7zGTnzPq:pHlDp4nn/RqBdXnSG2JdWlFZXTox2v
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\autorun.exe"C:\Users\Admin\AppData\Local\Temp\autorun.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x4f81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
16.0MB