Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
424s -
max time network
1146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
14/12/2023, 15:24
General
-
Target
Release/plugins/KeyLoggerOffline.dll
-
Size
20KB
-
MD5
d76c8cc9559d1f0ae9729dc399af11d2
-
SHA1
b1eccde399e2ef67abba9911e1974d1d07dff929
-
SHA256
eae3559f23034ef01b18b6cfd36101f46b79b359d7a82a3ba5671f37769e4ef6
-
SHA512
c42809a8f33460e61a91e06003286caa875abb86eba7e9b1aefcd36f43c9962db1c72b50b4aba7e61199b08da96dd022ed023dcfc9ca01501dc8a4ba9e36c018
-
SSDEEP
384:3hQwETvQ1kuczBhB/vfAuRUmz1nU2TvxRHVEAidn9eT0pqfAp0FS8EQ1NSR:R7GBhauRxnUmRH0/z9Q1NSR
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Release\plugins\KeyLoggerOffline.dll,#11⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD56213fdd1a95d60a4e61367c08143fe83
SHA1a43998a46d3dbd17bd9c8b8f931bee5a62c13348
SHA256b9be7070c27c5d7f0a0682fa6f9802db84c3072506796b4d9a2d301d212d0069
SHA51272d2fd81dcdc4d0d1d0367ec8afafa16304808697553a2fbf25895bf2a1fae451936362369bdf3d53d54c0fc2344c58e78df43a12a73d14b1e238a6b299da9fb
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB