Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
31/08/2023, 19:00
General
-
Target
c6fd4e5cf7f4a94543c59b268be1cd9769fa394af04cca60e794d74a370af0c6.exe
-
Size
76KB
-
MD5
39a69e2092379cae354b478923c444f6
-
SHA1
d73d141828c245976fdc08daf7db0a5a1a9f838c
-
SHA256
c6fd4e5cf7f4a94543c59b268be1cd9769fa394af04cca60e794d74a370af0c6
-
SHA512
ae20c74bc497e0b09e349cfb51a8471a18d7dfa22d188a8ce9e03dfb53225981edb1852af9d6aa9094a19502b8204aa3ab22f179a06fe3731489c086c4250540
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOppz:GhfxHNIreQm+Hiepz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6fd4e5cf7f4a94543c59b268be1cd9769fa394af04cca60e794d74a370af0c6.exe"C:\Users\Admin\AppData\Local\Temp\c6fd4e5cf7f4a94543c59b268be1cd9769fa394af04cca60e794d74a370af0c6.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5cdec6bd48241f4c081cce1092ed6ee10
SHA1d491bd9f1aebc356f6a63554c8a593ca59ede830
SHA2561af0e80f3c5056c031a4d46d8d027ec484507d84fa4538b55bdf7236995cf7b5
SHA51295103a18eb6f4948f64e5705aa79ab4d07b7e9a4e301a0541341d2dd4de826568dac48a9469e7da52df14b5e0e65b1c58cb7656435b13fbe086dd917a5c22f26
-
Filesize
76KB
MD5bcbd4a1fda971d78099a6d72722c0b2b
SHA1254c9f9e8f6034ad3ef40299abc33d6257e13545
SHA256502f146496cc0618f7f5e8448e008e4a274e7f0b28c868dd3743107b46895224
SHA5126d474abfe458032571af90c5343d2e6c8ec299d837f0246cc1bec3976a142944c98317d5a17cd3a9264b7d5bd956010a8da1ee922db6e65967e9d2978bd9a8a2
-
Filesize
76KB
MD5bcbd4a1fda971d78099a6d72722c0b2b
SHA1254c9f9e8f6034ad3ef40299abc33d6257e13545
SHA256502f146496cc0618f7f5e8448e008e4a274e7f0b28c868dd3743107b46895224
SHA5126d474abfe458032571af90c5343d2e6c8ec299d837f0246cc1bec3976a142944c98317d5a17cd3a9264b7d5bd956010a8da1ee922db6e65967e9d2978bd9a8a2
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB