Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2023, 11:31

General

  • Target

    d940fc2bd86643851a70208c77b064bf52d6a85458b3debce4ab2ae214a10456.exe

  • Size

    5.2MB

  • MD5

    dba59a039b435c4e2923bf84b4dcf50e

  • SHA1

    2b638b620b8c84e27e71e1490c1e4876d9794b83

  • SHA256

    d940fc2bd86643851a70208c77b064bf52d6a85458b3debce4ab2ae214a10456

  • SHA512

    a790ec49475e63118a4ba1b92c8b3cb10c06dd9a7ba32573abdde9dad155a2f286abfb6018dd2a9ac26b3fcdef30769055fb2946e44ff2309d2bd4bbc0ede1f0

  • SSDEEP

    24576:96l+DmI77HnUEJ3wXaSuT78yAcFfTlclzO26z0hf9NsHiMh:99UGSYAchAG9C

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d940fc2bd86643851a70208c77b064bf52d6a85458b3debce4ab2ae214a10456.exe
    "C:\Users\Admin\AppData\Local\Temp\d940fc2bd86643851a70208c77b064bf52d6a85458b3debce4ab2ae214a10456.exe"
    1⤵
      PID:2304
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k netsvcs -p
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:3988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2304-0-0x0000000000400000-0x0000000001EBA000-memory.dmp

      Filesize

      26.7MB

    • memory/2304-1-0x0000000000400000-0x0000000001EBA000-memory.dmp

      Filesize

      26.7MB