Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

3

Mindshb.exe

windows7-x64

5

Mindshb.exe

windows10-2004-x64

5

Resubmissions

21/08/2023, 17:42

230821-v96gzseg78 5

21/08/2023, 17:39

230821-v8b7ragd6v 5

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2023, 17:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Mindshb.exe

  • Size

    6.6MB

  • MD5

    03a0f731d1fda4521dc912a2cd4f7d04

  • SHA1

    e1e8fa96208ebe91a6259d9f51249098c4d6897e

  • SHA256

    18a900e972aff001241d8e676c52c94156e3b8d68e0f82d8cd07607f1664bdf1

  • SHA512

    2e29551ce0951fe2cc7c6aeb4bff7ff5233634dda12c8d4d36b13caaa7113188d2e6adb07a4d236d16ff783c40f7c7cf886bcb5542cbb43267d01c164c350abd

  • SSDEEP

    98304:n6NB1lxxHcTX+6DxiYmpDl2yK1ERMKdY/RPl+qqKem89lh0vvi9QPyyMxoFpr:631lxx8TO6DxbmhUEh+4KefJOMU

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mindshb.exe
    "C:\Users\Admin\AppData\Local\Temp\Mindshb.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mindshb.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mindshb.exe" MD5
        3⤵
          PID:3944
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:3180
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:4660

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2448-134-0x00007FFB6D6F0000-0x00007FFB6D6F2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2448-133-0x00007FF682D60000-0x00007FF683898000-memory.dmp

          Filesize

          11.2MB

          Download

        • memory/2448-135-0x00007FFB6D700000-0x00007FFB6D702000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2448-137-0x00007FF682D60000-0x00007FF683898000-memory.dmp

          Filesize

          11.2MB

          Download

        • memory/2448-141-0x00007FF682D60000-0x00007FF683898000-memory.dmp

          Filesize

          11.2MB

          Download