Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/07/2023, 13:53

General

  • Target

    b838edd541829b_JC.exe

  • Size

    2.1MB

  • MD5

    b838edd541829beb6c708fdb45ca94c6

  • SHA1

    e9869626fb54ad414ae7c6684c1fa905067c680c

  • SHA256

    73fb4f2ef418b2bdf578f09df324711cbcd4689e4f622b7944aefa0317b2c1a0

  • SHA512

    2be06750abc00b28b87cbe84f1e59be3325175c4cf227263960f999bbd1a7f2d18cec967c39b6d3a68f4c3709af05471e9bbc4c4d80fe5886bfafc28d602e2db

  • SSDEEP

    24576:8i5WyAHIlqh2hvhuQZlNVHhZ4H9w0Z2CCwaYJoRk:8i5QwuQZlNVB0w0HCwaYJom

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b838edd541829b_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\b838edd541829b_JC.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1388
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3900

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads