Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2023, 06:48

General

  • Target

    b9dc1e58009bd04353c3d9ec524578ace60d0dd49709b356c36c969c3b787485.exe

  • Size

    81KB

  • MD5

    7833a4ae985c56c64bb62456b4cbda71

  • SHA1

    cf320643e8c48cf753fc8c4992526625e1c086c6

  • SHA256

    b9dc1e58009bd04353c3d9ec524578ace60d0dd49709b356c36c969c3b787485

  • SHA512

    e5edcc105922a6774d3d5153dc72a714ec66af98e65b8e5e9a32f98f29f9a4c1fb5018e27d3b8e9f36d31de50b214d97eac1b85ff1eb1978e7ef9702b5bab604

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOoA1cfYf9:GhfxHNIreQm+HiXA1cfYf9

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9dc1e58009bd04353c3d9ec524578ace60d0dd49709b356c36c969c3b787485.exe
    "C:\Users\Admin\AppData\Local\Temp\b9dc1e58009bd04353c3d9ec524578ace60d0dd49709b356c36c969c3b787485.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    82KB

    MD5

    19b5f2715d8522c5a9fb4c3668d9f17a

    SHA1

    8eb3a1b67a0ff9f650fc1f43866513f5a272742a

    SHA256

    6e06ebdb2af86033742c9747ffa78aef524392fa175905b67430d677caea8b16

    SHA512

    853ef802c344a47198f023e8b34a148500b606147774b4dc5d0efbe3ef854bb2e5e5b59506986518b7cc1be3f78b8c10f6a10aa6d0123cfff73c7d46e11e59c8

  • C:\Windows\System\rundll32.exe

    Filesize

    75KB

    MD5

    090d6ab884b36a98b9e34d85129833f2

    SHA1

    1d80a00431e58872f1ec6256102097db0ea9434b

    SHA256

    4f92162d5d5f9fabb7a7280c466e0cda06e755a59c3232f89506ee61d3764622

    SHA512

    f51726ddb6bde4016ffbf6cc9227c12246aad720af2b68d39c0a3b4017854aff005a501cb06b51e01e967abaab5350af934a50142eaf0e62ef7178ff4b41cbd5

  • C:\Windows\system\rundll32.exe

    Filesize

    75KB

    MD5

    090d6ab884b36a98b9e34d85129833f2

    SHA1

    1d80a00431e58872f1ec6256102097db0ea9434b

    SHA256

    4f92162d5d5f9fabb7a7280c466e0cda06e755a59c3232f89506ee61d3764622

    SHA512

    f51726ddb6bde4016ffbf6cc9227c12246aad720af2b68d39c0a3b4017854aff005a501cb06b51e01e967abaab5350af934a50142eaf0e62ef7178ff4b41cbd5

  • memory/4780-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/4780-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB