Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
15/11/2023, 17:45
General
-
Target
869ec3df6a7bee8f076c73ec1fb35d80af72ca846e051199ecd1102c6faeff75.exe
-
Size
13.7MB
-
MD5
a714ddc6076916b1c688b86338a43336
-
SHA1
d73fd48a4e7db3f44b001c54dff63b9258e6dfaa
-
SHA256
869ec3df6a7bee8f076c73ec1fb35d80af72ca846e051199ecd1102c6faeff75
-
SHA512
a0c7c9bade112f518d2db56eb3b6ad6a6cbbb3b118d7a6e41832264c552553288312b44f0682566a0e567a945591581a1ae8112741cfd5a05b4d79e2d0831bdc
-
SSDEEP
196608:8MD+cpvJ/4H3nmghWoa/fsysMF4JD85l3kjiFJlzLJZzoFWe4fyGsnIRHqrB7XLI:8MFgXnU7sEl3yiLzMwRxnsxJ72
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\869ec3df6a7bee8f076c73ec1fb35d80af72ca846e051199ecd1102c6faeff75.exe"C:\Users\Admin\AppData\Local\Temp\869ec3df6a7bee8f076c73ec1fb35d80af72ca846e051199ecd1102c6faeff75.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\奶罩子轮回.exeC:\Users\Admin\AppData\Local\Temp\奶罩子轮回.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5a4db9ccf43c0d361c99255091be684a0
SHA1073e82d4e325d6f5d7b14638ef2cce50fdadc181
SHA25636272e829db2cfbec2d33a8d1f5ef6004454f513921e64406e5f343eacf84578
SHA512acff520e9da5d56309ac5606aa3235f832faccabb19841de674bdae7f95c9c3f43d6f0b95100555b9295e9e56373d4b0d067c8a5863f95a68897fc7b24274b29
-
Filesize
32KB
MD56dfed3d17627244147b6fb19cb0577cc
SHA1a6c0deeb8b8491ad6afce1cbfe45631d4ba10d7d
SHA25611b2e4bb75bf9776ac776b4c201b8ca1f52f559c02c808ef62b79fccfb35c525
SHA51201fa024923d115be9cd6790c6112c3cfa21705cbec16e24e1f782a22f58014ae240c2d78c4569829cb48ed4e4642f85b5d8669e52a188edc988eae742383f15a
-
Filesize
308B
MD54ac55e95e3b40750ac81edc530b189be
SHA103c8a05dffa337b6093426d37f6fdf58e775cc12
SHA2561514e6fcba6161c81c80da821c4a1dbb1622cd0426d790ce174d971dddbbb55b
SHA5123f1ad127ac2d45a09c26579806bc1b02d710610a61901336b0cd44a45b8d932819020809066544e1fe71d81629e5f68bffefe7785ea7084353367d2bc024c075
-
Filesize
8.0MB
MD50f79956e611a733dbd438dc8a9bed0df
SHA12a83a037ac20d30879d831e9007e2d35e7ec98ba
SHA25649670cde80663d5ddfab7ca5bf5f78d3398a513ee91debc7f74abab9afe8b335
SHA5125fc52c85db35b2cd538c1005552012d30b9a6fb6fd8e6e3f31a72ccb5f3cb958fea3f991e01f6637cfca909aa5c1e853f3f66fc917043927b244760d974691f3
-
Filesize
8.0MB
MD50f79956e611a733dbd438dc8a9bed0df
SHA12a83a037ac20d30879d831e9007e2d35e7ec98ba
SHA25649670cde80663d5ddfab7ca5bf5f78d3398a513ee91debc7f74abab9afe8b335
SHA5125fc52c85db35b2cd538c1005552012d30b9a6fb6fd8e6e3f31a72ccb5f3cb958fea3f991e01f6637cfca909aa5c1e853f3f66fc917043927b244760d974691f3
-
Filesize
4KB
-
Filesize
15.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
15.8MB
-
Filesize
1.1MB
-
Filesize
15.8MB
-
Filesize
15.8MB