Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

04/08/2023, 02:03

230804-cgyybsaa9w 3

02/08/2023, 17:53

230802-wgaqaahf2s 3

Analysis

  • max time kernel
    143s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 17:53

General

  • Target

    40899d038ee717f6e407ed53668c8d16.exe

  • Size

    542KB

  • MD5

    40899d038ee717f6e407ed53668c8d16

  • SHA1

    6f49f6ce4068524aab980fce4c85473f63415d5f

  • SHA256

    d0d417ece8e94dbb4834e29c345d2e05de5de8ba3b3e05d922614c6f508d4cbe

  • SHA512

    b7e8de2f51c235adc3243781b797663de6557acb8ecee58310a9944a199b2ae0c38663e0b97f77477ea850439d45dbdff11fb8cfcfb4fc9c58442c965999c389

  • SSDEEP

    12288:FVcSX+wMmdF1/jILYCWilocbzK27bwgTysayxbLz7ms4u6m7PH1:FVcSX+wrd/r3IO2g06Pg/1

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40899d038ee717f6e407ed53668c8d16.exe
    "C:\Users\Admin\AppData\Local\Temp\40899d038ee717f6e407ed53668c8d16.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2004-133-0x00000207C57F0000-0x00000207C587C000-memory.dmp

    Filesize

    560KB

  • memory/2004-134-0x00000207C5C60000-0x00000207C5C7A000-memory.dmp

    Filesize

    104KB

  • memory/2004-135-0x00007FFA4EEC0000-0x00007FFA4F981000-memory.dmp

    Filesize

    10.8MB

  • memory/2004-137-0x00000207C5C30000-0x00000207C5C40000-memory.dmp

    Filesize

    64KB

  • memory/2004-139-0x00007FFA4EEC0000-0x00007FFA4F981000-memory.dmp

    Filesize

    10.8MB

  • memory/2004-140-0x00000207C5C30000-0x00000207C5C40000-memory.dmp

    Filesize

    64KB