Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 17:54

General

  • Target

    361.cmd

  • Size

    567B

  • MD5

    feb810eaa38eb0890ad2034d322e4c79

  • SHA1

    a7c7ddd0bd405b949ddbffed364269d145ee78e4

  • SHA256

    e346f4ed81e3e7974c4a9978789fc08737abc4c7318f31d747b1ad23ce5bf800

  • SHA512

    f96b5e8129ab8fd4703a2e4bddf4245e9c4a64a8d69663f755386021cb8fd34a75bd0fa53b4579145bf50be2948d9ae5d0f4bdb556ae73b4cc85e6a2130f5ab9

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\361.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1540
    • C:\Windows\system32\reg.exe
      REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.dao666.com/?cmd2" /f
      2⤵
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      PID:696
    • C:\Windows\system32\reg.exe
      REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "http://www.dao666.com/?cmd2" /f
      2⤵
      • Modifies Internet Explorer settings
      PID:4664
    • C:\Windows\system32\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"
      2⤵
        PID:1640

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads