Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2023, 15:07

General

  • Target

    migrate.exe

  • Size

    527KB

  • MD5

    e037f718b8cce79341ada551605a430b

  • SHA1

    3cb5fd873c934859ebb3518bb0e2659afb1fd43e

  • SHA256

    d36071884086b10b302c2acd43c33d15fe73369b927ba9002d32db9409567241

  • SHA512

    4ece2e71e02a543e5d6ab9bece7ba4f467ca888ae5cfbcf40616ea233d3372bd37d199b33b6a725db0fc71a6e4210272b60a822cd8a76d8d6a5ebc8996c0abbb

  • SSDEEP

    6144:OAWCdX5gCP7/rut/WunWx+rcn1taJZZsHrZa6Igy5RmK/MR/D2lDeDiXAR3AM7O1:rdonbg1fhbUO3A+vO4xQ

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\migrate.exe
    "C:\Users\Admin\AppData\Local\Temp\migrate.exe"
    1⤵
      PID:2628
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:5116
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5072

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2628-0-0x00000239BB190000-0x00000239BB218000-memory.dmp

        Filesize

        544KB

      • memory/2628-1-0x00007FF9C7A30000-0x00007FF9C84F1000-memory.dmp

        Filesize

        10.8MB

      • memory/2628-2-0x00000239D5950000-0x00000239D5960000-memory.dmp

        Filesize

        64KB

      • memory/2628-3-0x00007FF9C7A30000-0x00007FF9C84F1000-memory.dmp

        Filesize

        10.8MB

      • memory/5072-4-0x000001C620550000-0x000001C620560000-memory.dmp

        Filesize

        64KB

      • memory/5072-20-0x000001C620650000-0x000001C620660000-memory.dmp

        Filesize

        64KB

      • memory/5072-36-0x000001C6289C0000-0x000001C6289C1000-memory.dmp

        Filesize

        4KB

      • memory/5072-38-0x000001C6289F0000-0x000001C6289F1000-memory.dmp

        Filesize

        4KB

      • memory/5072-39-0x000001C6289F0000-0x000001C6289F1000-memory.dmp

        Filesize

        4KB

      • memory/5072-40-0x000001C628B00000-0x000001C628B01000-memory.dmp

        Filesize

        4KB