Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
21/08/2023, 11:52
General
-
Target
8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
-
Size
5.8MB
-
MD5
dde5b7a0f954e8263b022811c3305866
-
SHA1
151ccc12e558bd3fb7a2014c25b75f052319f61e
-
SHA256
8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
-
SHA512
57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
SSDEEP
98304:NTE6ZBd1H4f9dqvy6BockCIUS1OtWq+StwuowSLokM6VoA0DTtrlK58vGz+Tf4Ay:NT7LQ0ao8CIUCUWqFm11Q6Vo9thK/ziT
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"C:\Users\Admin\AppData\Local\Temp\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
-
-
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exeF:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"4⤵
- Executes dropped EXE
- Enumerates connected drives
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
53B
MD587b828f00e8a78f1d0b8c34d672b53a5
SHA1186c545bbd56a0086fbcf302dac6f7365676b087
SHA2567f89dc9a76fd40ffd15196ca0fb37ac8fb49084fe3ea68f0a42cbd577177d1a3
SHA51272cd61df813e3f0f18daa95a70ec7313b520587c92eaa0af0cfb6b4512ebe0bf77975659ab06f36d3546c336f9bd36e36fd04a949112aefa652e22addccb08bc
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
32KB
-
Filesize
28KB
-
Filesize
12.9MB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
12.9MB
-
Filesize
11.4MB
-
Filesize
732KB
-
Filesize
11.4MB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
12.9MB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
11.4MB
-
Filesize
732KB
-
Filesize
11.4MB
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
11.4MB
-
Filesize
12.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
12.9MB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB