Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

SecuriteIn...86.exe

windows7-x64

3

SecuriteIn...86.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2023, 08:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe

  • Size

    943KB

  • MD5

    f8db9ff5bdcf53ae061463e8663a9219

  • SHA1

    3c7e2872408ce2b1dea988843543024a44a7d1c9

  • SHA256

    50644de70b66f0785381df5f875b3de0f5a3d13e9eb2798cebcb23bb0ebab385

  • SHA512

    2b1208c9673027d13a8e29d9fe8731676c07275fb8e4360fe573f4d726a7063fbdffee046b97a7b28a0537472dbcfc5c1d2d92cf837d958293258721e348b41e

  • SSDEEP

    12288:3iMq/jOzDsy86GT/KhUzgZiQAi3C9tDNf98fpIE4S+yHHM05QM:ALOojTsUBQAs0A4JynMqQ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WVThSG.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2248
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WVThSG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2C1.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2840
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe"
      2⤵
        PID:2464
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe"
        2⤵
          PID:2520
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe"
          2⤵
            PID:2500
          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe
            "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe"
            2⤵
              PID:2484
            • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe
              "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2431.12186.exe"
              2⤵
                PID:2588

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpE2C1.tmp
              Filesize

              1KB

              MD5

              d6cb5837ade5a24b80103e58f3c9bc36

              SHA1

              bc9fcb98d0054868bad1a22362866680fb76e396

              SHA256

              2b1c3616b2a6a95a89f5dcd6871649989443886789763d28f028132e044faa23

              SHA512

              10fe2e7faa5d822e98aae34d8e03709eff299ed5e39a598fea6273c6c5bbbe480b533fbed3b21dbc9eaa4b91fe53a34159b0e37b0336834850aa2b17ece1addc

              Download Submit

            • memory/1712-4-0x00000000748C0000-0x0000000074FAE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/1712-1-0x00000000748C0000-0x0000000074FAE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/1712-3-0x0000000000760000-0x0000000000778000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1712-0-0x0000000000360000-0x0000000000452000-memory.dmp

              Filesize

              968KB

              Download

            • memory/1712-5-0x0000000004E00000-0x0000000004E40000-memory.dmp

              Filesize

              256KB

              Download

            • memory/1712-6-0x0000000000640000-0x0000000000650000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1712-2-0x0000000004E00000-0x0000000004E40000-memory.dmp

              Filesize

              256KB

              Download

            • memory/1712-15-0x00000000748C0000-0x0000000074FAE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/1712-7-0x0000000007FF0000-0x000000000806C000-memory.dmp

              Filesize

              496KB

              Download

            • memory/2248-17-0x000000006ED90000-0x000000006F33B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2248-16-0x000000006ED90000-0x000000006F33B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2248-18-0x00000000003C0000-0x0000000000400000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2248-20-0x00000000003C0000-0x0000000000400000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2248-19-0x00000000003C0000-0x0000000000400000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2248-21-0x000000006ED90000-0x000000006F33B000-memory.dmp

              Filesize

              5.7MB

              Download