Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2023, 11:24

General

  • Target

    Sourceforge_2415.exe

  • Size

    24KB

  • MD5

    266a15d9cba058894d2831ebcb588cbb

  • SHA1

    d2e0bd146f8fbf8fdfc7077e3ddf49c921a6f7fa

  • SHA256

    665da077f722090af0926c306b1463fee6e29edce548e7a6cb994a0038df077f

  • SHA512

    b8b401a8c6e087ef70ef755843c15151dc68a27f6a4821c86c2539e62e807e1e8f99ea67b5ae0c76d8a9e839dfe1d45e786c236550357a79410348a759db6d1a

  • SSDEEP

    384:bZmvgok696u08/P7Qo7EdAcMEalE3UWB8gw8/:bZJ8/MpdyPJWLw8/

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sourceforge_2415.exe
    "C:\Users\Admin\AppData\Local\Temp\Sourceforge_2415.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 764
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2928-1-0x000000001BE20000-0x000000001C2EE000-memory.dmp

    Filesize

    4.8MB

  • memory/2928-0-0x00007FFBFC2F0000-0x00007FFBFCC91000-memory.dmp

    Filesize

    9.6MB

  • memory/2928-2-0x0000000001480000-0x0000000001490000-memory.dmp

    Filesize

    64KB

  • memory/2928-3-0x000000001C390000-0x000000001C42C000-memory.dmp

    Filesize

    624KB

  • memory/2928-4-0x00007FFBFC2F0000-0x00007FFBFCC91000-memory.dmp

    Filesize

    9.6MB

  • memory/2928-11-0x00007FFBFC2F0000-0x00007FFBFCC91000-memory.dmp

    Filesize

    9.6MB