Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
07/11/2023, 10:40
General
-
Target
017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5.exe
-
Size
3.2MB
-
MD5
de05b086e58900dbba82bb3e7ea33d48
-
SHA1
c30888e59588016b2b52d10754f484ebc58208e4
-
SHA256
017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5
-
SHA512
eca6258d34e6452c159a98e37a62d61294daffad6de8844823165effb4ccb01e0e9d4a9f3e5f96a30e14f34939aa834882a7d6eb4ead25821fa56b62ab1e80ab
-
SSDEEP
49152:Ep/LKtx/0q5FQHVJaMEOAFItRd297EzuSgRgc01XLX9KiaZUjMehUbc:EpzKf/BkTaRFkJy3aBFDR4V4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5.exe"C:\Users\Admin\AppData\Local\Temp\017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5.exe"C:\Users\Admin\AppData\Local\Temp\017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5.exe" -gpipe \\.\pipe\PCommand97Getscreen.me -gui2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5.exe"C:\Users\Admin\AppData\Local\Temp\017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -child2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Getscreen.me\zceuxiijtdbnmaapjkyfidysoufgpdb-elevate.exe"C:\ProgramData\Getscreen.me\zceuxiijtdbnmaapjkyfidysoufgpdb-elevate.exe" -elevate \\.\pipe\elevateGS512zceuxiijtdbnmaapjkyfidysoufgpdb1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
673B
MD5fd8251ba7d4346486277d5804b6247e7
SHA16aa1694d08e5d61faf7c8d0eff20317fc6ab5f7e
SHA256cf3ea5b1a770c6e1d49923b1c07509184bd7aa6f7307881f6cf910390da6a9cc
SHA51247489c8086e566312bc359044323b3f48b457cd09608c1a907e413267589a796dd7af831ac6064eeb75af51770d0779fa099eb0a62e0daa1f029f9f50bc18a05
-
Filesize
2KB
MD5eaaf32cfe15c9edf75040713b21cd074
SHA157bdc913ed472be061d980da0d86c783ef332c67
SHA256ee0d4c3f0086086aca901899cc294de4598104c95e9a7dc87cc9894306d648f1
SHA5129038611623007d086de6cd8be025f176739ab6f739e2ce8ae994d8aad51f0c849ead248de036af41c9c2fe3cd55f1ccca8dda32d1320a3e2132a505593e5b0ef
-
Filesize
261B
MD57ed45ee9df05fe6a4462e5bc5495024c
SHA1e09f868b12d82fcc9577dc1908897d5681001934
SHA25640064c84b42e90a71c64cc24b8b997f5ea6753b04650a3d9eb04b0bfec889e1b
SHA512d02952966c618edb0ecb098cb563872c9acf99e63a1b1b3d921ef11a2d6a325d04d513804285a9fb0a5d71132821a39926cc2dfa660b8cc0eaed591acf6f6299
-
Filesize
16.0MB
MD54b1b4e345cc5f2c368f3ac861ef9cf78
SHA159a6c0a73cb6e95ab5ff8575cb5777ee7945dd0c
SHA256ae8286341fde8f581c76ee67718d602efcc5d94de663d2054f9dca1a6195e987
SHA5122dd27dc84c14f7d88bee7494900a68149d6d7de1db768d92e6fc69263646f0e7a22dddb36aadb35d4176fa284b16d293356a0403e87b758e13b859a6368edc0d
-
Filesize
3.2MB
MD5de05b086e58900dbba82bb3e7ea33d48
SHA1c30888e59588016b2b52d10754f484ebc58208e4
SHA256017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5
SHA512eca6258d34e6452c159a98e37a62d61294daffad6de8844823165effb4ccb01e0e9d4a9f3e5f96a30e14f34939aa834882a7d6eb4ead25821fa56b62ab1e80ab
-
Filesize
3.2MB
MD5de05b086e58900dbba82bb3e7ea33d48
SHA1c30888e59588016b2b52d10754f484ebc58208e4
SHA256017d07923c535e1ab56b0a7e42da0fb396b61bc74dfbcb51a51b504ff34ae3e5
SHA512eca6258d34e6452c159a98e37a62d61294daffad6de8844823165effb4ccb01e0e9d4a9f3e5f96a30e14f34939aa834882a7d6eb4ead25821fa56b62ab1e80ab
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
22.8MB