Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 22:20
General
-
Target
3fb01b99289afbb69f94fb5d7895cd44.exe
-
Size
48KB
-
MD5
3fb01b99289afbb69f94fb5d7895cd44
-
SHA1
d43882830dc42599c284ffb24d10a88419b793a9
-
SHA256
c6eed847f0d3522fbcdfbbc4a7806e6943d9a3fbb3e1cfeb95bd0d87eb776145
-
SHA512
133b1eddf081d66894c4a4a1603a80e8808ecbe31e8953a1208d5c03309ebaa979b11a06874d8dd06f18f2deb26dfd66a6d5eadc7680a7128bbdd8b1015c6e61
-
SSDEEP
768:to4IuGXkKB/eln6kH2rZc+Ed8k/UM8LWIUFuITZe7E9QFpoINPz87:XGXkKFekLZk/UzLWIUt8I9YSINPK
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exe"C:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exeC:\Users\Admin\AppData\Local\Temp\3fb01b99289afbb69f94fb5d7895cd44.exe2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\live.messenger.comC:\Windows\live.messenger.com1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\live.messenger.com"C:\Windows\live.messenger.com"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD53fb01b99289afbb69f94fb5d7895cd44
SHA1d43882830dc42599c284ffb24d10a88419b793a9
SHA256c6eed847f0d3522fbcdfbbc4a7806e6943d9a3fbb3e1cfeb95bd0d87eb776145
SHA512133b1eddf081d66894c4a4a1603a80e8808ecbe31e8953a1208d5c03309ebaa979b11a06874d8dd06f18f2deb26dfd66a6d5eadc7680a7128bbdd8b1015c6e61
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
300KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
299KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
299KB