Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
13/11/2023, 03:20
General
-
Target
wwwroot/_content/Saturn.Backend/img/Anims/Saturn2.png
-
Size
57KB
-
MD5
0e4ed170be2ac6e61a1206b30f126809
-
SHA1
4eb4df9714efcb738dde3685036471fbfccd0d82
-
SHA256
a33a9c45cc7cbe3e127dbb82e0616b9033a4bd988d9458d617557af59321f0a1
-
SHA512
f7ead79b366b39fc5bedcc21a4f4a5577582fab1cb9f2ca86841dbcb79879e0d07873818972c70e2e1de4c7eeca0489e0c60dfa850e0b860fd4fe701c37d6ead
-
SSDEEP
1536:XTK5u3zyBSOnbaDL3mjlJUywo2LkO2rjnZ:G8OnbaGpayvEkO2rbZ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wwwroot\_content\Saturn.Backend\img\Anims\Saturn2.png1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD598e471793bc98d3077336085b22ee0f8
SHA1b6f8e7d4cf2d98b8fc39f39f29313460688ddf7b
SHA2560a6215f8788556edaaa73cd13ded08e28c4b36e6fe2504709e1c2d057b2499e2
SHA5124d47799d716f22b0cf49675ff09389ed68f8f30912464165759d7b7d4a46b4534efc63bc5c6dae11cddc16bc105c9e6a5c6f38c7fc6f90671ea46389de35b0a4
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB