Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    570s
  • max time network
    570s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2023, 16:38

General

  • Target

    Lethal Company/OnlineFix.url

  • Size

    46B

  • MD5

    59bf167dc52a52f6e45f418f8c73ffa1

  • SHA1

    fa006950a6a971e89d4a1c23070d458a30463999

  • SHA256

    3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e

  • SHA512

    00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\Lethal Company\OnlineFix.url"
    1⤵
      PID:4332
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:4908
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:956

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

        Filesize

        16KB

        MD5

        ae2e8df3d3a65644b12315c3b1367d26

        SHA1

        e03a34e8dfea774229d6288eb47da6f269c4320e

        SHA256

        74bb9f74e76a57867ffa19da04767cd4f8d23c128854ed04e6fc5b5ceeac3836

        SHA512

        302d9eb37c419b31b9d9d84d7842e184d1304e0b811616b9008efdea99c911c90d169f1ede27594a902141a6c84aa72be5e3f3821020a3c07f94d6ebef46f7b5

      • memory/956-40-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-42-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-33-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-34-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-35-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-36-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-37-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-38-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-39-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-43-0x0000023853A00000-0x0000023853A01000-memory.dmp

        Filesize

        4KB

      • memory/956-32-0x0000023853DB0000-0x0000023853DB1000-memory.dmp

        Filesize

        4KB

      • memory/956-41-0x0000023853DD0000-0x0000023853DD1000-memory.dmp

        Filesize

        4KB

      • memory/956-0-0x000002384B740000-0x000002384B750000-memory.dmp

        Filesize

        64KB

      • memory/956-44-0x00000238539F0000-0x00000238539F1000-memory.dmp

        Filesize

        4KB

      • memory/956-46-0x0000023853A00000-0x0000023853A01000-memory.dmp

        Filesize

        4KB

      • memory/956-49-0x00000238539F0000-0x00000238539F1000-memory.dmp

        Filesize

        4KB

      • memory/956-52-0x000002384B1F0000-0x000002384B1F1000-memory.dmp

        Filesize

        4KB

      • memory/956-16-0x000002384B840000-0x000002384B850000-memory.dmp

        Filesize

        64KB

      • memory/956-64-0x0000023853B30000-0x0000023853B31000-memory.dmp

        Filesize

        4KB

      • memory/956-66-0x0000023853B40000-0x0000023853B41000-memory.dmp

        Filesize

        4KB

      • memory/956-67-0x0000023853B40000-0x0000023853B41000-memory.dmp

        Filesize

        4KB

      • memory/956-68-0x0000023853C50000-0x0000023853C51000-memory.dmp

        Filesize

        4KB