Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
28/08/2023, 10:20
General
-
Target
6b509fed42dc14155c2e7d110a1972406ec3f11b96a57047c130a93227dc5ee6.exe
-
Size
2.2MB
-
MD5
bf64e1b5eef9890c378080d15ecd732b
-
SHA1
125e63aae2210a3388195f551309648d07007014
-
SHA256
6b509fed42dc14155c2e7d110a1972406ec3f11b96a57047c130a93227dc5ee6
-
SHA512
1d72564e558df9a4cc8d7f222cc4174cd6d05ac921f96aa057deaa7dd321d6f124a0287b11e832a328448a3ed9d111ac4b8e7d39f541f214babb1bc99b65aba1
-
SSDEEP
49152:kzazzvNts/2Acn9CkZ0X2hff/yC3G/8Kdden:k8zjoyrpR3fDKdden
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 5 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b509fed42dc14155c2e7d110a1972406ec3f11b96a57047c130a93227dc5ee6.exe"C:\Users\Admin\AppData\Local\Temp\6b509fed42dc14155c2e7d110a1972406ec3f11b96a57047c130a93227dc5ee6.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe"C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe"3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6B509F~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5ffe2e67500cbec81163c773dbb99d3fd
SHA110e51abed4debd3d3cbd02136d31b7984071eb51
SHA256c8395bac9040da5f5db5ef04f50feb556a42bbb5674b54074ffee88c7f34ae5c
SHA5129200419b67da7858235e713320b081d3b6c9952178eefbf65898bfcd8b745e84e26e89edb15acba4737e9ce411c9aa18b3fae6deaeaa7883a9c9dcf1db3381c2
-
Filesize
6KB
MD5b4b23094d1b4d5ddd7f6b29751a8bfe0
SHA13d8f3bb7d101a5b3ac8589d7ec48a1062dd173f0
SHA2566748bbd180f31ec9c180367899ac78f4292f6d271a62e40751dbf88019cd383d
SHA512092fe5b661ae83131f6a564834d5b09747046d650f0e593bc0fae8d798c83efdba9021e9793803e698539cd8c1d5f007b911e8d9e2f6df33e289dca0be1703c5
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
996KB
-
Filesize
996KB
-
Filesize
348KB
-
Filesize
996KB
-
Filesize
996KB
-
Filesize
996KB
-
Filesize
996KB
-
Filesize
408KB
-
Filesize
4.8MB
-
Filesize
224KB
-
Filesize
996KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
412KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
996KB
-
Filesize
108KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
6.0MB