Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/12/2023, 23:56
General
-
Target
44a832d85d5b5faf8eac1787295ba98d.exe
-
Size
364KB
-
MD5
44a832d85d5b5faf8eac1787295ba98d
-
SHA1
5b22a597b001c65127a40907cc65b1a4ebda30e9
-
SHA256
e3ca14b23d3f2a4d4642477183a4a52e804da09eb1576e9f9da49e016080bf0d
-
SHA512
5a275792652f5ae45450ef8a41c3424915e8951ff10d2ef25e2e26b42dc7475a1c5a4de3bc7519c567f20a4b4f7aafc0030e5c3587b873c97245ce097849af0a
-
SSDEEP
6144:MiRV+qT5KYaGySK87aog7NTOog89WA8CcPTHhBjLX0/6ql/JqpHq:MiCi5KYaGTaoye885CSThzq
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44a832d85d5b5faf8eac1787295ba98d.exe"C:\Users\Admin\AppData\Local\Temp\44a832d85d5b5faf8eac1787295ba98d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nCi01831hHkCg01831\nCi01831hHkCg01831.exe"C:\ProgramData\nCi01831hHkCg01831\nCi01831hHkCg01831.exe" BOMBARDAMAXIMUM2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\nCi01831hHkCg01831\nCi01831hHkCg01831.exe"C:\ProgramData\nCi01831hHkCg01831\nCi01831hHkCg01831.exe" "C:\Users\Admin\AppData\Local\Temp\44a832d85d5b5faf8eac1787295ba98d.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5b685ba12d35cf1ad87b72df4c2b12335
SHA11f7cf4758f160165ba7b95ef57dc5a19bd37fb0c
SHA256246dc2a88c3cded3ad78c5a538478d274171b311252140eddbd6ceda5ca22e9c
SHA512971374f6ba606569c7c42a4dde5974a1b58e641dd87663534164c734b16ef0a48e210977df49e2052769417f98965c6b9473cd0dfc0cced2205e844a623f1b7c
-
Filesize
92KB
MD595e05e04839ad289575090c4885507ef
SHA15d62bf2fde4f6fbb55a020efac136ad8aeda95d4
SHA256a908ce4a5a96927e48454972beba26fc155c1e130681454b91748d6f461a1cbd
SHA512fd452658e9946f64b40a0433fe84a5a65818441c7fb80835d419eabea3f6609da8296cf353cdcc70a257b5e65b5ca2e52ccd407d90f7c007137793d4ccacc8d4
-
Filesize
364KB
MD545f48f09642a4075aae0219211de7cd2
SHA12fcc23d417c2b1ff2b8c08b43aa9362726585c89
SHA2567ce53e5e87775bdfeeb4ece8e87a8225d2e914785456304a6533d7485d832405
SHA512e25449ecae0835f41d6bb3f2dbcc56c05746aa334fba2a496916919431673b027ce3c088ac8a79199d3e5a3a163e6f8db0745e08a02f2e7e113edc1df4efd3af
-
Filesize
812KB
-
Filesize
1024KB
-
Filesize
812KB
-
Filesize
1024KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
1024KB
-
Filesize
812KB
-
Filesize
1024KB
-
Filesize
812KB
-
Filesize
812KB