Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
271s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
30/10/2023, 15:44
General
-
Target
loader_64.exe
-
Size
7.2MB
-
MD5
4dd5c68b13c477a52c78e73485da537d
-
SHA1
5350d568f3b8ad99187658b33d27d56b4b7e9a8b
-
SHA256
6f700f26d07ac71f871247af062375dc8a8c8aaf3209bc87a4345a0199dd6863
-
SHA512
49b76a238aedf81d8d3923692c2a8db315f2cb202c318add07e7a817a1150b3f176e5cafcd773b823659df26273b44cb8cdfbd7a729bc542773ce763b3876988
-
SSDEEP
196608:gI4xsACmyov6kJS6YXApBH8u9hX9eDOgZvz3rZdXZ7M7RVbZq:iIMCt4pBH8uDX9eDZZnq7U
Malware Config
Signatures
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader_64.exe"C:\Users\Admin\AppData\Local\Temp\loader_64.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Files.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD535375f95b1430c8b11ebeb931fba0dda
SHA15122d139ac357db969c191b941bd479ceb9dc59f
SHA256fd5691afe44306226fa973037fe144c3214867067cf88cb2285394888d959d5b
SHA512b9043a4d4470ac90f83244a81fad5de8944b83ba1e8ab6bbc7d29fb216c2ded74bf1c7b1ca8c84535b989075660e83f676e273a1b524f9e5dd8e04fee412cc6b
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16.8MB
-
Filesize
16.8MB