Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
23/09/2023, 07:06
General
-
Target
7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe
-
Size
75KB
-
MD5
3213a6b12ab6e858c29394b46b600714
-
SHA1
e2867a66e24a661041cb6a6149b4fd6bec44feac
-
SHA256
7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9
-
SHA512
3cb34859ac5832797e135fadfc3b56a338c4c6743e5259d147cfd17502ed25c6ff47d21c01dde88043ce730c1270334e1784912e40a6af4185a9a573583f0990
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOeYh:GhfxHNIreQm+HiBYh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe"C:\Users\Admin\AppData\Local\Temp\7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD593b9d95f28a0375e94a2670bbb456e71
SHA184b3cc9160de726841ad2c044c859b41184f149c
SHA256541c486e7b0141e3619a7977df984001d8faaab6bb6f1eb10cff179970e583a6
SHA512539a8752e39e56911be217effdbb68fab88ffd8bd897795130c62d17e20991726a751751bb2a4efa3652d0981d5ddf5f1a19d5abcfb0e358220f61ab168adde2
-
Filesize
81KB
MD52995096ee91e04e0a8ba2aff104ea555
SHA18537d0559796d3066acaedb9453e461492f33732
SHA256c906459f115a04301a88fd4f842265465c305f564b4e06c8c0a8fe27f93e2318
SHA5122db39e5df3877bd2bc5fede50c5a89b7ab6123c4697a1f077a6301da94837201124dcaa02e79debd0ea746857668ab4262b057d4ca52ecca961d0d0c699eabde
-
Filesize
81KB
MD52995096ee91e04e0a8ba2aff104ea555
SHA18537d0559796d3066acaedb9453e461492f33732
SHA256c906459f115a04301a88fd4f842265465c305f564b4e06c8c0a8fe27f93e2318
SHA5122db39e5df3877bd2bc5fede50c5a89b7ab6123c4697a1f077a6301da94837201124dcaa02e79debd0ea746857668ab4262b057d4ca52ecca961d0d0c699eabde
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB