Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
231s -
max time network
247s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11/10/2023, 10:52
General
-
Target
a3a988df661670aabe916829162318250a0d2a0914955769fcdf5953f1411228.exe
-
Size
80KB
-
MD5
6683dda10dfbbf865ab5a17f4371ad13
-
SHA1
6b5a29e9347d70d9554d7b42799179278e882940
-
SHA256
a3a988df661670aabe916829162318250a0d2a0914955769fcdf5953f1411228
-
SHA512
df7006f2f18a9a23144c21c1d6ba09bd828b64868f2a9dffa157afb2134b0fcc23d41bbd86b85e53a7fec4a5d2387f8fbdc52d63872dcdd45f6755a4f06e4b3a
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOPIDo2:GhfxHNIreQm+HiUIDo2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3a988df661670aabe916829162318250a0d2a0914955769fcdf5953f1411228.exe"C:\Users\Admin\AppData\Local\Temp\a3a988df661670aabe916829162318250a0d2a0914955769fcdf5953f1411228.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD57830c28da33d47d8640f6519457b89d0
SHA1d6e49ee0e99edcb3446dcf3f3574cfaafe906de2
SHA25684f8620540d62fa815b588d051804f83d741fbbd5d792805ec7762bb4a5bdc44
SHA512470091e9a6b3362ffe575faec17db8f7f26275473b1219474768e3c283feec01fd1512f59b2f6d372e9dc2a4a21c81bae2026ed8b4755dc9dac23a993913db9e
-
Filesize
81KB
MD51fe1d7c7e3fe7612a1fbf7ee56755426
SHA16880538402fd300688b971d8f860504a69fbdb3e
SHA25691191093a8de2df1be4f5b2b3d5c8d2336166ed79d553cea12c2b9b1c5b89727
SHA512766184d0223ecde9836b06cd158774c3ca394ae8ec7b88a22d6b8bf701df1cb1d8ed6259560f3ae45b6e673b36c1b6438c9332947151fa6a0c039a4cd0e28f75
-
Filesize
81KB
MD51fe1d7c7e3fe7612a1fbf7ee56755426
SHA16880538402fd300688b971d8f860504a69fbdb3e
SHA25691191093a8de2df1be4f5b2b3d5c8d2336166ed79d553cea12c2b9b1c5b89727
SHA512766184d0223ecde9836b06cd158774c3ca394ae8ec7b88a22d6b8bf701df1cb1d8ed6259560f3ae45b6e673b36c1b6438c9332947151fa6a0c039a4cd0e28f75
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB