Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
01/09/2023, 03:22
General
-
Target
3134871e1d6aeab6d3a5ff5e23e9cde40f50b2f36ce1031403f4457958c1df08.exe
-
Size
76KB
-
MD5
24aa1892cc9a6e754550df904bdf242c
-
SHA1
63bc9ac9b0ec45517191a7b2e3ededf79907e429
-
SHA256
3134871e1d6aeab6d3a5ff5e23e9cde40f50b2f36ce1031403f4457958c1df08
-
SHA512
8485fe49bf6d9e376a6093afe12d9e520ae87e5178e3129bc51d4d18cd3dda105ac864360f879aeb7100101e0c205a7044108c68982b97d0b9beeae48753c6e8
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOA:RshfSWHHNvoLqNwDDGw02eQmh0HjWOA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3134871e1d6aeab6d3a5ff5e23e9cde40f50b2f36ce1031403f4457958c1df08.exe"C:\Users\Admin\AppData\Local\Temp\3134871e1d6aeab6d3a5ff5e23e9cde40f50b2f36ce1031403f4457958c1df08.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD5ca4f7660ec4441b11104fb403de311f1
SHA1032084c95cf271545ea59b7a28e7b26e89f0df50
SHA256b0165298e9d6e1494269c5ca0c98169c32f0edc271cf8582f84d0369c4be290d
SHA512d39eea34a177eb58f9dcdfa84d18716e504a5c1fe2002a3fe735279612eee6f37adf9f168d728ce9f0cea5fff1ff21124dd4959dde3ce04b0ffc0d3dcad4c5c2
-
Filesize
78KB
MD5d2f1469a3efd615ae90b59ae68493d68
SHA1b45c6d92b073327760fd5f90834caefdb78dbbd5
SHA25677af6f4a128214d02f68c7e5678eaa0347ee13258afcb803de1458db09554f83
SHA512919f7a2d22608e49168f5c6ec16bf07291c2de5dade2b57a110169132492e41a54d8ebedcffc1f0071533ef291f739118823566940deda8362a1aa8153640cde
-
Filesize
78KB
MD5d2f1469a3efd615ae90b59ae68493d68
SHA1b45c6d92b073327760fd5f90834caefdb78dbbd5
SHA25677af6f4a128214d02f68c7e5678eaa0347ee13258afcb803de1458db09554f83
SHA512919f7a2d22608e49168f5c6ec16bf07291c2de5dade2b57a110169132492e41a54d8ebedcffc1f0071533ef291f739118823566940deda8362a1aa8153640cde
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB