Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 01:02
General
-
Target
0aeb2f1ce3ab5067177c9cf1ab3ab4ac2b6b9a42931bd6120fedc91047eb46b0.exe
-
Size
75KB
-
MD5
6540d02754d72902cdae93bf3fda7d3f
-
SHA1
04ef874fea17e8e79408122aaca0fa7473242956
-
SHA256
0aeb2f1ce3ab5067177c9cf1ab3ab4ac2b6b9a42931bd6120fedc91047eb46b0
-
SHA512
a965d973d10b0926706e7120e704639774133e1041311fc3bc9988b5a9039d46177e83ebe89785feb17bc6283097b311302305c5ab3905cf998a9bc9540f94cc
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOK:RshfSWHHNvoLqNwDDGw02eQmh0HjWOK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aeb2f1ce3ab5067177c9cf1ab3ab4ac2b6b9a42931bd6120fedc91047eb46b0.exe"C:\Users\Admin\AppData\Local\Temp\0aeb2f1ce3ab5067177c9cf1ab3ab4ac2b6b9a42931bd6120fedc91047eb46b0.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD50bf0f91e5b4aa1884373b5104e3a8342
SHA1b7a48b9d117397d70a1d7ad378f0dd35e6b63683
SHA256a31ecc79a8bda28a2f0eafba55a7b8af850a6cba8d6cccb31af97e38b066db10
SHA512955f76a3eda460dceb2521d0a9a777f3a78adeba89f821703b9171330cb855125f51e46c46dde3eace7270cfc36081f6744791ca0ec8fdc2bf9f29170221120c
-
Filesize
74KB
MD591dfb8b1c42ee33b6573a641c84bb24f
SHA1cf37db86e9c76ba09d1650d3030c20c32a61859b
SHA2568acc65579f6b0207e59e5d08774628ca7af69bb6a71ca37a3f860b9c79252cde
SHA5129f237333c3b0a459e35c05a6c661c0b966817a213b888ae7a8fcdc6bdeb05c40b44b58addd6389a542bcd7e1d2a7d1cdeb40894545b73d092304e313e8ccabf3
-
Filesize
74KB
MD591dfb8b1c42ee33b6573a641c84bb24f
SHA1cf37db86e9c76ba09d1650d3030c20c32a61859b
SHA2568acc65579f6b0207e59e5d08774628ca7af69bb6a71ca37a3f860b9c79252cde
SHA5129f237333c3b0a459e35c05a6c661c0b966817a213b888ae7a8fcdc6bdeb05c40b44b58addd6389a542bcd7e1d2a7d1cdeb40894545b73d092304e313e8ccabf3
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB