Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 02:46
General
-
Target
App/DirectoryMonitor/DirectoryMonitor.exe
-
Size
1.9MB
-
MD5
ae0bc60a12ca3a32afb32cf17f44282a
-
SHA1
9100660d3e5daaaa810c8161d8ae25f2b0b54209
-
SHA256
242e6e9e8ef08501d6f97e408b2fff7d7141baced8214250219cad7c8a3b08dc
-
SHA512
72ed571b2a236415b20bfa6f7c1e4847df525b0f3a729e2f025236f6586254604f3a71dea282c9a9d0b2c8909e27fa67eb558569a362668ae82af8204afbfe56
-
SSDEEP
12288:4kLywLk29CPs+RkZL+AFncWlBI4g4dxCMDL6rkS:4ZECUXc+pgqCRrkS
Malware Config
Signatures
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\App\DirectoryMonitor\DirectoryMonitor.exe"C:\Users\Admin\AppData\Local\Temp\App\DirectoryMonitor\DirectoryMonitor.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\auditpol.exe"auditpol.exe" /get /subcategory:"{0CCE921D-69AE-11D9-BED3-505054503030}"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\auditpol.exe"auditpol.exe" /set /subcategory:"{0CCE921D-69AE-11D9-BED3-505054503030}" /success:disable2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\auditpol.exe"auditpol.exe" /get /subcategory:"{0CCE9223-69AE-11D9-BED3-505054503030}"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\auditpol.exe"auditpol.exe" /set /subcategory:"{0CCE9223-69AE-11D9-BED3-505054503030}" /success:disable2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178B
MD514f709eb94bfa215bbafde7401e15a7d
SHA1154c7ce46d4d0de69b20ffbf934addc5957006f5
SHA2569502e9e22c93b8291c9764d98c993753844b2d756b20f23e813575a3c225c8f7
SHA51215ad946047e86d6efe184bc1c3940f9f9be47531ca02d4c033138211f0065217dc8ed3926378797d59505e24e7fdbde29b79c56fd322121d901cddf7c3466ea2
-
Filesize
1.9MB
-
Filesize
144KB
-
Filesize
80KB
-
Filesize
184KB
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
40KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
296KB
-
Filesize
232KB
-
Filesize
152KB
-
Filesize
872KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
552KB
-
Filesize
64KB
-
Filesize
912KB
-
Filesize
40KB
-
Filesize
128KB
-
Filesize
224KB
-
Filesize
96KB
-
Filesize
120KB
-
Filesize
112KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
472KB
-
Filesize
152KB
-
Filesize
528KB
-
Filesize
80KB
-
Filesize
288KB
-
Filesize
112KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
10.8MB
-
Filesize
384KB
-
Filesize
56KB
-
Filesize
344KB
-
Filesize
7.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB