Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 04:32
General
-
Target
3235913053e2fadfc2cead1cb4045a32d70edbee63d73f6ae31489675cf4a086.exe
-
Size
81KB
-
MD5
39946c783d92988d63d627ec98e0077c
-
SHA1
234072a15b1cb89fbde180d4a2380871ba6d04e2
-
SHA256
3235913053e2fadfc2cead1cb4045a32d70edbee63d73f6ae31489675cf4a086
-
SHA512
b8280ce9f5a420ab2164ace726f2f88e02ace732c1e59b8de47b2e3ca434a792b54c32a3972af2d20d2250f247f190cf2f865d56376e3a438c1b8b50a490092f
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO0j:RshfSWHHNvoLqNwDDGw02eQmh0HjWOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3235913053e2fadfc2cead1cb4045a32d70edbee63d73f6ae31489675cf4a086.exe"C:\Users\Admin\AppData\Local\Temp\3235913053e2fadfc2cead1cb4045a32d70edbee63d73f6ae31489675cf4a086.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD54231978b8f669707cecb59fc7e2e6c58
SHA1cd73f4c623f4ab57135f1f58bbdd5974b7895adc
SHA25639e53e7ff822e74af48737c8596c36d9adb6eb4b2364e39bc9ff7fc553a91551
SHA512d2a49b01ac53e7bd7f431128f223a806274da135ae26701481f9e5536a06d1618e9ff2ad8d1de88a2475d531da1e104cd598689fbb95143b608c48402bdadee1
-
Filesize
82KB
MD562b2f9915ac9cd0116c955759e487aac
SHA1e643084f7b3eb835fcee0e8fe8a4ae320fc3e567
SHA256c4837c7dd23db8356b2b894becfbcd308f38f1a2a52708f729e1bdc395e64179
SHA5125edf6d8222dc9cd1ad8c08cf68471e41b2579df2527acad2392d512822181817147b732e105ed4fd2ab34d2ad8609045631d6b305b494d8ff8fd09efa1c65c57
-
Filesize
82KB
MD562b2f9915ac9cd0116c955759e487aac
SHA1e643084f7b3eb835fcee0e8fe8a4ae320fc3e567
SHA256c4837c7dd23db8356b2b894becfbcd308f38f1a2a52708f729e1bdc395e64179
SHA5125edf6d8222dc9cd1ad8c08cf68471e41b2579df2527acad2392d512822181817147b732e105ed4fd2ab34d2ad8609045631d6b305b494d8ff8fd09efa1c65c57
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB