Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

8f91270393...64.exe

windows7-x64

4

8f91270393...64.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2023, 02:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f91270393aa3e39bd0e8acab2635d368aac68c73753f527bef97a382aec0964.exe

  • Size

    10.8MB

  • MD5

    d05802d515cdad20eeeef558dc2bff9f

  • SHA1

    d302e703615ff56055485a995a7b90e128f9857f

  • SHA256

    8f91270393aa3e39bd0e8acab2635d368aac68c73753f527bef97a382aec0964

  • SHA512

    8b2ee7eb77ba6075586fc73c6681174df0a3fe3e2597b25a684367611aec8b2724c4aa3832c15b5c1cdae699e4447fb2928cd44e77747abefce88e6b4309b171

  • SSDEEP

    196608:NY3OCtHmo04r5A3Xu/h2YKI660xhzDlo/auuaI4KbGqVPNu0bmrl:N3CtlrKO/PKID0DloCuuauyq1Nu0bmZ

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f91270393aa3e39bd0e8acab2635d368aac68c73753f527bef97a382aec0964.exe
    "C:\Users\Admin\AppData\Local\Temp\8f91270393aa3e39bd0e8acab2635d368aac68c73753f527bef97a382aec0964.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\GoodZip\conf\ListView.ini
    Filesize

    301B

    MD5

    1b8afc1afb1d967a83c6a44c96524992

    SHA1

    ac570da6a99f12fba1ee34476ce8bbbba22930ee

    SHA256

    cf4377b4f5b1fda7396f795472e6fcf675db2a82e45ea78122c047efb5830d10

    SHA512

    052d56f1b9a45e0804f3e6a6823c36fe5634e19e402d6f149cb2788273e3614f4759837d87129563b9bc585aa849d5b0bafec5235e5c87c8cb63e4a12314e898

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\GoodZip\conf\ListView.ini
    Filesize

    639B

    MD5

    a110fefd038d6b148e32661fb1139b51

    SHA1

    02296a9331eb9f101e18778dfe30981c374c2d5a

    SHA256

    2740ac94ba858571df0ff230c630713c161164ebcb44c3a3fb08785d2d364550

    SHA512

    45761e49ba7df2ca20864adfb6b56fb0db1aaeaa30e116f4abf24c2c7c1e4f56361566f0d7a7ed21f8a4baaf2d3fbb80b058b7046af92c65c1f290e628e164e8

    Download Submit

  • memory/3604-0-0x0000000000340000-0x0000000000E295BF-memory.dmp

    Filesize

    10.9MB

    Download

  • memory/3604-57-0x0000000000340000-0x0000000000E295BF-memory.dmp

    Filesize

    10.9MB

    Download