Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 22:10
General
-
Target
f763d94277d59808962be33b86df067190ee9b6b80f603b5c24ff6dccef4d9d1.exe
-
Size
75KB
-
MD5
6ba341cfcc42a10afc9c93e8f2cd2002
-
SHA1
dd4840f0f1616eb889a177b85c9cf4224c4211ee
-
SHA256
f763d94277d59808962be33b86df067190ee9b6b80f603b5c24ff6dccef4d9d1
-
SHA512
9bb48dd9cb103c9f457c058e0c1baa31324b7a8dd40b4ddfb2b8551c9fb90072a51b6332db05c72983a59ed16b103c0768708d2b2bee46f3d8245e79e8f8b00d
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOXz:RshfSWHHNvoLqNwDDGw02eQmh0HjWOXz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f763d94277d59808962be33b86df067190ee9b6b80f603b5c24ff6dccef4d9d1.exe"C:\Users\Admin\AppData\Local\Temp\f763d94277d59808962be33b86df067190ee9b6b80f603b5c24ff6dccef4d9d1.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD50c3c48ef764ddd1468541baf81dcde76
SHA1b8abebceb3d8cf46961816138ba29eabcc7b9e4e
SHA256de8b225f47aae6eda753928dd2aaeed3787a8af30577ecd34f95e754079f804f
SHA5123b4e8380859a0cbeacf31e41085c0397e124a0c31570942c44131a39cdca53c5ca933b0201a365df498a86ecb2f91dea87aae9df5858fc6d6720e719aea5581a
-
Filesize
80KB
MD5c5986cdc114b71caab1626f87a73d37b
SHA105cd12fd7a214ff9468ab2ea1810ecdb9b45bb6d
SHA256e5638354b0f16c3eeadf37e89b11bc944bde4e7a070a538909bdb421e7a43013
SHA51280f21210ff558918a0e61c4b74aceb5a5e02c73957d1baf66e5ba90fbc44776f763fd22e7c192cee285b3de6dca44e4541877f71532abadfa4a5ff30d3ec1a17
-
Filesize
80KB
MD5c5986cdc114b71caab1626f87a73d37b
SHA105cd12fd7a214ff9468ab2ea1810ecdb9b45bb6d
SHA256e5638354b0f16c3eeadf37e89b11bc944bde4e7a070a538909bdb421e7a43013
SHA51280f21210ff558918a0e61c4b74aceb5a5e02c73957d1baf66e5ba90fbc44776f763fd22e7c192cee285b3de6dca44e4541877f71532abadfa4a5ff30d3ec1a17
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB