Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2023, 01:59

General

  • Target

    RuntimeBroker.exe

  • Size

    100KB

  • MD5

    ba4cfe6461afa1004c52f19c8f2169dc

  • SHA1

    ab8539ef6b2a93ff9589dec4b34a0257b6296c92

  • SHA256

    e86870769ee6c797e09457bd99c58d9bf2303cf0193a24ef9b1222c2c3daf628

  • SHA512

    2c5190d7609767237311260f241c619b82434ca640f396bb9710d356286844f82f320f9e05525a38707f2a52977790c0c3e2a217b36a7f0095a87c138b939af0

  • SSDEEP

    1536:l5gC0wSKok6UAeVEBFgvozLmwCedFpQHI8PXjYlTx/2whBGE/5K5/EJD2VEUcO8h:sC+vEArBCgmejo8X/2whRJDAE2r+e

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\System32\rdpclip.exe
      "C:\Windows\System32\rdpclip.exe"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1676-152-0x00000260CCD80000-0x00000260CCD90000-memory.dmp

    Filesize

    64KB

  • memory/1676-153-0x00000260CCD80000-0x00000260CCD90000-memory.dmp

    Filesize

    64KB

  • memory/1676-157-0x00000260CCD80000-0x00000260CCD90000-memory.dmp

    Filesize

    64KB

  • memory/1676-137-0x00000260B2730000-0x00000260B2755000-memory.dmp

    Filesize

    148KB

  • memory/1676-156-0x00000260CCD80000-0x00000260CCD90000-memory.dmp

    Filesize

    64KB

  • memory/1676-155-0x00000260CCD80000-0x00000260CCD90000-memory.dmp

    Filesize

    64KB

  • memory/1676-154-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

    Filesize

    10.8MB

  • memory/1676-142-0x0000000180000000-0x0000000180029000-memory.dmp

    Filesize

    164KB

  • memory/1676-151-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

    Filesize

    10.8MB

  • memory/1676-150-0x0000000180000000-0x0000000180029000-memory.dmp

    Filesize

    164KB

  • memory/2136-146-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

    Filesize

    10.8MB

  • memory/2136-134-0x000002349A1F0000-0x000002349A1F1000-memory.dmp

    Filesize

    4KB

  • memory/2136-133-0x000002349A1E0000-0x000002349A1E1000-memory.dmp

    Filesize

    4KB

  • memory/2136-140-0x00000234B3FA0000-0x00000234B3FA1000-memory.dmp

    Filesize

    4KB

  • memory/2136-139-0x00000234B3F90000-0x00000234B3F91000-memory.dmp

    Filesize

    4KB

  • memory/2136-138-0x00000234B3F80000-0x00000234B3F81000-memory.dmp

    Filesize

    4KB

  • memory/2136-136-0x00000234B3F70000-0x00000234B3F71000-memory.dmp

    Filesize

    4KB

  • memory/2136-135-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

    Filesize

    10.8MB