Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
05/10/2023, 17:48
General
-
Target
ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe
-
Size
274KB
-
MD5
39bd4507e22dd521757969971a05a33b
-
SHA1
1183e86495850692d5f012eb0181e9fc0acf2eae
-
SHA256
ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a
-
SHA512
b926ee636e3f85d170fec75549faf615f6218e4d2c3e87e38faa5707a020ee69b821a2557d88860d5f9604c9580d0cb4d155a5e986795a9488960244be5b5996
-
SSDEEP
6144:bbTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:bPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 9 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 59 IoCs
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe"C:\Users\Admin\AppData\Local\Temp\ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD520a6c9ee4e457267adf58889fb1dd617
SHA16cb2beebd527ed5f77a13228f93eec7af88b822e
SHA25645be093d2a1d3beb6db08a3e71cfba063736edd92a18302cf5f6fefc13bfab3b
SHA512d4ff64a5b7af4119c739e605a1dc7710175090ae8363b2e73976bea8555e07e63380255a534b3389e61a3e7e6a1cc67b969e2f912d6978e45d39243455114e28
-
Filesize
1KB
MD52a61a3d0f5beb7727441b0e010c30d7d
SHA12dc8b67f13196d3a658d79c9c575bf0a0b75da15
SHA2568f97e861acd3950fde5361476dd989039edff251a00b7de4df84cbacfa629a0d
SHA512d29a461cd7c4746015684c9213a72748d5440191b4b9f07209723e0b8e2b59f11cafe4b87acd123d2987ed1990d3204402f69b7f78f8607782c441efb307a12a
-
Filesize
599B
MD51cf46555b125f8cc867f47959d154a8f
SHA1bb50ee9a070c5aa2c6eb8787d3cc2493f898a67e
SHA2566229116ce9e3c490303c8c3e136280af7f790b1f89a3e908587e4152783c5b73
SHA512cfdaa0fa8a2cf07483c07a4f9da5bf3b78a49bfc209505b674264ceafb7c08a78249dabd7114f366123b5a1fa227f8ddbabf4dfe903573bd4e539c5102f4f6ba
-
Filesize
484B
MD56491f63d9bca674fb59086b41a0d8d00
SHA13b7847268912cf2bb00d947866042878ed2a9363
SHA256243f46ad82fbb0d3f376ec52819582523fc8b3480ac2819a2bc8cde72003f840
SHA512b652139d47d4c9c43986191d8c129b078f73a7651b511de4ba36fa1aa791a90ec2ad84148bb6954846acf3d05535b401b43be74c1cc7ae2cc9262437411a236a
-
Filesize
482B
MD5cf18452fe138ec0f85d6c7364ab07f3f
SHA19c1fcce77f52100b4a1a4d2ecb80b0d049fc79f8
SHA256adf1fe40a493b22412f0caa09754f90aa907d0c655c1be32bb9881bbd9cd2727
SHA512b09a1537a7c7d40b076e96e0d70c8bb25848ec8e8dee5c9cfec93e8ab91af1d256fd3170ee4c39c231e9fc4b6437d34e4a35bedbc30f5ce9ade9814f4687e037
-
Filesize
504B
MD5801aa45435ea78d5ef42ec3b64ef335b
SHA12b5d43af57401c24e2925164be91364a0b1e1b41
SHA2567959d8dbc977f737ce89dae4b79af5df26fe6ec277a6b9d29760aebf02573beb
SHA512499a1e29a2ff81fe05bb8abf3f469d7ff05770fff122979b0d08102a5bb52e25f2be86a64dbd94ac425cbb9dce42731bb5ceb79d9482b16e41ba8d55f9c159e4
-
Filesize
447KB
MD5c067e740e28bca4a142e050bd7c99c3e
SHA1c80f128d80e62680a229f3d148059098f6084459
SHA25677d55bfb2ebb9cbe7a70a8f29aedb4faf8aa417fbb7e715e72844914e56b4c06
SHA512d5e654534ac8720fc01f88ee4c62863d47994929b7401eebf7584e6d407d853132dae41f8a718acd5a9600735659aef00cdbf2a0bfeb0134b10a8ecf387c5659
-
Filesize
415KB
MD58bed3af00177017f96ed5ade4634ecd7
SHA11a5b72fc80c5114662fa2117a367007d9be87902
SHA256f1b5069aa1ddac8955198606a044b7e504fc31bbe6b9ef959183bef18d324a09
SHA512a97818f012d894b3bd7789973cb3e4d56de3b48c349a9ea206df90a35d1d6b2fc40bb628874c7b52b4599ced94963072c5aff62a398e2375ab6a9618f97c9b65
-
Filesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9
-
Filesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
4KB