Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
108s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2023, 21:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mrinfo.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
mrinfo.exe
-
Size
636KB
-
MD5
ed8a02662e0a07f949837fba2ef9b9a1
-
SHA1
68083ab97cba9c8937ad43d09fd843d973d0fad4
-
SHA256
635535006c48140282f0ed1e7925958c171e97b9dcf03a17d00bd771412d5f30
-
SHA512
51c7340933e0bb44721bf93642a47eb4331fbf64cc951d61dc90451a76f102c7df5a2b6edbbf20eeae46791aa7721e8e0918af23a0c5006b69a742a94d6c874a
-
SSDEEP
12288:Yy22wXB2TkGoKHmeT6KbvOoQ9JS88vS57GTSireo2YDMIkm70Ott2Y:YDDXwTkGPHpcoQR57u5Dd2Y
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2760 mrinfo.exe 2760 mrinfo.exe 2760 mrinfo.exe 2760 mrinfo.exe 2760 mrinfo.exe 2760 mrinfo.exe 2760 mrinfo.exe 2760 mrinfo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2760 mrinfo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15 PID 2760 wrote to memory of 776 2760 mrinfo.exe 15
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\mrinfo.exe"C:\Users\Admin\AppData\Local\Temp\mrinfo.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760