Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13/10/2023, 21:13
General
-
Target
pozemenutroll.exe
-
Size
14.8MB
-
MD5
86d5019d46253f5efacaf182e41fbd26
-
SHA1
f62eef1bbc213651c8cd6e93faf07dcbbe80198a
-
SHA256
e2b945c729a639d8d2e5924e98a65a6792e2bac3b17813c9f9e845e34f84b4b9
-
SHA512
3b2cfbc58d9b754d02b89df1784c7e7403d28d9bccb97776c86149f9b4c616792d5a674a0c1e79b23986b417b44ead092af75920beede4073fe3f0bd3c0b655f
-
SSDEEP
196608:4BLhL4YrNZv+dV+VcjfFvQU0gGunkLAMECCLi7mi3Pc/dV2K35cBwkagMgn+ryP5:4BNQ+QhcdXLg7qjE2K35AwkagMdy
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pozemenutroll.exe"C:\Users\Admin\AppData\Local\Temp\pozemenutroll.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c MODE CON COLS=55 LINES=122⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.comMODE CON COLS=55 LINES=123⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
27.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
27.4MB
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
27.4MB
-
Filesize
1.7MB