Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
Resource
win10v2004-20230703-en
General
-
Target
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
-
Size
1.2MB
-
MD5
9c867cfa11ef97ff46e3a56fb34af73d
-
SHA1
b7559650173c346f72de9a8bf4c0eb21a7802c39
-
SHA256
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1
-
SHA512
a52343e53265c9239b6e6ad91abee77a602995e243d5b52576a6a8d0114af7976c31802a8ce7ac6fb9870da4ace2fc1ac5544667031dc2d44f2619d0e3072610
-
SSDEEP
24576:gpGHEHpX0oxQjUo123oqb7XF0tPrBjH9/Idy/G3i/nh:gnXtxo1FkGZVztIy5nh
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5040-0-0x0000000010000000-0x0000000010017000-memory.dmp upx behavioral2/memory/5040-1-0x0000000010000000-0x0000000010017000-memory.dmp upx behavioral2/memory/5040-18-0x0000000010000000-0x0000000010017000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\M: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\N: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\O: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\P: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\R: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\T: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\A: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\Z: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\U: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\K: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\S: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\W: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\B: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\Q: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\V: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\I: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\G: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\H: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\L: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\X: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\Y: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\E: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 5040 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe Token: SeCreatePagefilePrivilege 5040 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5040 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe 5040 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe"C:\Users\Admin\AppData\Local\Temp\0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
51B
MD5d4b764f603e826edd5ba0d5c09f95390
SHA1fab2158dc4fdf2cd3eae3e666a56f79234c8e2f8
SHA256fc0aba460f046d6141230f39047577b6d785e71b116a99023ecb39a350bb3192
SHA512d52046e23ad436f75edbe1c9838aaeb96ed6bad252c7ee74796ee744caabd6aac2f74ac2e6490b499753846e45295f427b33ba5a878fcf5534eb07b98f1173df