Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2023, 02:06

General

  • Target

    1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe

  • Size

    11.1MB

  • MD5

    4edebaf2db8a9692c62283a06ba37cc8

  • SHA1

    ac698b4892c703ab1df30ad3995bef26537771df

  • SHA256

    1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c

  • SHA512

    9c411787cd579ff405c6f4ea863d3354cf9199315951ac04d84cfd06c21efa2dac0a74ea83b61c2cb30e129fdfad41e53008a003e64e7e54588d0404a9121644

  • SSDEEP

    196608:+pjfEMCIgaPQ5sjWwjNvexZtT4gaZD/oStzCX/eu7aVhJnwz0a:+xxxgaPQqO94rD/oSgjaVTwz0

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe
    "C:\Users\Admin\AppData\Local\Temp\1eea5073c05f06eb99fc1a0bc1f19a9641037d507dadb6a4620cd875a563c93c.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/676-2-0x0000000000400000-0x00000000019AD000-memory.dmp

    Filesize

    21.7MB

  • memory/676-0-0x0000000001B50000-0x0000000001B51000-memory.dmp

    Filesize

    4KB

  • memory/676-1-0x0000000001C80000-0x0000000001C81000-memory.dmp

    Filesize

    4KB

  • memory/676-4-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

    Filesize

    4KB

  • memory/676-3-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

    Filesize

    4KB

  • memory/676-5-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

    Filesize

    4KB

  • memory/676-6-0x0000000001CE0000-0x0000000001CE1000-memory.dmp

    Filesize

    4KB

  • memory/676-7-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

    Filesize

    4KB

  • memory/676-9-0x0000000000400000-0x00000000019AD000-memory.dmp

    Filesize

    21.7MB

  • memory/676-12-0x0000000010000000-0x000000001003C000-memory.dmp

    Filesize

    240KB

  • memory/676-21-0x0000000004D60000-0x00000000055C4000-memory.dmp

    Filesize

    8.4MB

  • memory/676-23-0x0000000004D60000-0x00000000055C4000-memory.dmp

    Filesize

    8.4MB

  • memory/676-27-0x0000000003A50000-0x0000000003A77000-memory.dmp

    Filesize

    156KB

  • memory/676-28-0x0000000003A50000-0x0000000003A77000-memory.dmp

    Filesize

    156KB

  • memory/676-42-0x0000000004D60000-0x00000000055C4000-memory.dmp

    Filesize

    8.4MB

  • memory/676-43-0x0000000000400000-0x00000000019AD000-memory.dmp

    Filesize

    21.7MB

  • memory/676-44-0x0000000000400000-0x00000000019AD000-memory.dmp

    Filesize

    21.7MB

  • memory/676-45-0x0000000010000000-0x000000001003C000-memory.dmp

    Filesize

    240KB

  • memory/676-46-0x0000000004D60000-0x00000000055C4000-memory.dmp

    Filesize

    8.4MB

  • memory/676-47-0x0000000004D60000-0x00000000055C4000-memory.dmp

    Filesize

    8.4MB

  • memory/676-48-0x0000000003C60000-0x0000000003C61000-memory.dmp

    Filesize

    4KB