Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
16/11/2023, 22:07
General
-
Target
e717697078ba05c6e1bfc6c4f78ea129e0bf47bba53923f497597d2910661f4b.exe
-
Size
2.6MB
-
MD5
3aa6a5f20235719d8961de7400c58729
-
SHA1
4c7c165312a90a00a773c1aeff18d61de5ebbf51
-
SHA256
e717697078ba05c6e1bfc6c4f78ea129e0bf47bba53923f497597d2910661f4b
-
SHA512
cdd93ce07c0cc699dc18c57b99786387949fddfad60a1af5a53c3124447ed68fb4237fb8973cc4d78fc0085e714aad45e3407ab5c8c0914f6b3aff8e50af9a77
-
SSDEEP
49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTl86zWyN8Ps8Oa3vo:Q+8X9G3vP3AMW6Ky8b73g
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 6 IoCs
-
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 8 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e717697078ba05c6e1bfc6c4f78ea129e0bf47bba53923f497597d2910661f4b.exe"C:\Users\Admin\AppData\Local\Temp\e717697078ba05c6e1bfc6c4f78ea129e0bf47bba53923f497597d2910661f4b.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5a854c577fd52d32726cd2d82a6c402d1
SHA1c59c412b0c8feb244b3d63a6c83ed673551f82b0
SHA256e15768dcef473e64864fb1c91620f3511054ba63324e39878b69471528622fd8
SHA5122bbf87fee4289714fe353fbae8c5f1952492ffc27fc0e060a5fc245d2a0221853e0614107231bb787f5642e2214bc95495a4cb95566b0bdadba96468423e5413
-
Filesize
412B
MD53c4eeff38066f2507643fb1836bf7a12
SHA151dbe21504f817d744a2feac16d4f515c1c73b03
SHA2566874c3804417261e27b813c1ace4603736ce86684ade0f02a198650606830968
SHA512941a4f964c45291f8815eb21e59a2174e357612f8884366a8976bc9e88a52acf41a8ba90c88d1338f8d9015576705c8a66c050ba18958351b898ddf93ce8bb59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
2KB
MD5a2b88dc1762755d42c7d3ebe460f7284
SHA1ae8e8477d516686f89142c74948a3c2f924d603a
SHA2569b6a4367ab87fcd394cfef44df024543248546a34dec4f5f039b425f5ad147f0
SHA5129f01d86fce3b331bd1ef9ed6b5ee3184fe4b7c11d48476574dcd96bd8d3341d0d6cb228abfd39e784a5aa46c517c4b2ede59a02380b7b7b72ec23fa04664fa62
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
97B
MD58d6e57645a3894c78fedfd96931fb799
SHA18fa46e487e762948f191626bc0e39bdf52b4a367
SHA2569dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24
SHA51214947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB