Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2023, 13:53

General

  • Target

    dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13.exe

  • Size

    1.7MB

  • MD5

    7e6b2abd5cb72394f7ee4e2a7ae9d341

  • SHA1

    b3fb7caecc5740a002f7ce7b8686bbc3a0d277ad

  • SHA256

    dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13

  • SHA512

    1e2b2de049a22a543c178583528c75bbf141a212ae6184cdbaeaece55974c5d3b03d0222b3aab44c55dec5e22387e6b69b6a4ca3e568b4e999cb842e070af258

  • SSDEEP

    49152:rZshVjrZHNgWmABIrdHtAptgbeDyQ5rp:erl+Wm4pptgblQ5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13.exe
    "C:\Users\Admin\AppData\Local\Temp\dc75fff0d2596aeb0916bc38fbf7ab7d95a2c791e89ef3b0cea108f0695c8a13.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3808
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System32\alg.exe

    Filesize

    661KB

    MD5

    d0f6cf7a647eb2c83b7113d8152b27f0

    SHA1

    62d1650fc89a52bafb656554502f165b025a7715

    SHA256

    11b23e6ad5bbbcf0b74e1e4e5468b0b7b7691916fe0b2cccc4f96a02d1afea56

    SHA512

    2e8b5c0aa9a494f564dbe5f36860e0a614f38ed1e30704b772325916d3efaafe82f75349b3466a3afa85b1ab286fb38920eb47c601adc5cc5687a8edc031f193

  • memory/3504-149-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/3504-150-0x0000000140000000-0x00000001400AA000-memory.dmp

    Filesize

    680KB

  • memory/3808-133-0x0000000140000000-0x00000001401B9000-memory.dmp

    Filesize

    1.7MB

  • memory/3808-134-0x0000000000430000-0x0000000000490000-memory.dmp

    Filesize

    384KB

  • memory/3808-141-0x0000000000430000-0x0000000000490000-memory.dmp

    Filesize

    384KB

  • memory/3808-145-0x0000000000430000-0x0000000000490000-memory.dmp

    Filesize

    384KB

  • memory/3808-147-0x0000000140000000-0x00000001401B9000-memory.dmp

    Filesize

    1.7MB