Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
25/10/2023, 10:50
General
-
Target
38e48171841e732efe6ce8b4713c315a805a6cbb347eb98b9a6e4daeb230b095.exe
-
Size
24KB
-
MD5
1974b3efe52893678a024e9fe8ff07a0
-
SHA1
4d5b9d7b81cf7e38e65d402bf30a3b90f7271022
-
SHA256
38e48171841e732efe6ce8b4713c315a805a6cbb347eb98b9a6e4daeb230b095
-
SHA512
7c98e10b7978bd873fb7aafd10aae3ab1cff58bff152f9c3d7ef83d89d0fbe14e3a6ca715f89d904400fd1b9390f2c4cd243b4151b05e931ec8aede3c6be12de
-
SSDEEP
384:fLX3Wg+PHCBRWL8yER7HJ7v3Ir4zYV4IysmRJqn:jXGg+PHCBRWLtExHuuGejP0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e48171841e732efe6ce8b4713c315a805a6cbb347eb98b9a6e4daeb230b095.exe"C:\Users\Admin\AppData\Local\Temp\38e48171841e732efe6ce8b4713c315a805a6cbb347eb98b9a6e4daeb230b095.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\rundll32.exe"C:\Users\Admin\AppData\Local\rundll32.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD51974b3efe52893678a024e9fe8ff07a0
SHA14d5b9d7b81cf7e38e65d402bf30a3b90f7271022
SHA25638e48171841e732efe6ce8b4713c315a805a6cbb347eb98b9a6e4daeb230b095
SHA5127c98e10b7978bd873fb7aafd10aae3ab1cff58bff152f9c3d7ef83d89d0fbe14e3a6ca715f89d904400fd1b9390f2c4cd243b4151b05e931ec8aede3c6be12de
-
Filesize
24KB
MD51974b3efe52893678a024e9fe8ff07a0
SHA14d5b9d7b81cf7e38e65d402bf30a3b90f7271022
SHA25638e48171841e732efe6ce8b4713c315a805a6cbb347eb98b9a6e4daeb230b095
SHA5127c98e10b7978bd873fb7aafd10aae3ab1cff58bff152f9c3d7ef83d89d0fbe14e3a6ca715f89d904400fd1b9390f2c4cd243b4151b05e931ec8aede3c6be12de
-
Filesize
416B
MD5ed1c40917f1c39d4f6525a3f0650396b
SHA1decbe0e54e3eb3dfb7dc162e2a00a58fc577cf71
SHA256467c933d9e855bfaf8fd8d10abaae1541bd6693eb3da471f3ef99e5cefe3a7a3
SHA5129f22e24c70c2806af5c18354d82934973b544a2938081d230e96ff5457c741d28ae9722f2499e71902c8f1c65a2f1c769fceb4ab86b036e9ead2bef88871b87b
-
Filesize
48KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
48KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB