Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 02:57

General

  • Target

    015445c335f7f72a0b76901c681f48a7.exe

  • Size

    299KB

  • MD5

    015445c335f7f72a0b76901c681f48a7

  • SHA1

    67a8092f792bfa24690ab4ae96d2648c4b431708

  • SHA256

    03a8df88247ad7c2639b144187f8c6a8f03ec7ce02de0eaa4d2b0c6aa0da4e53

  • SHA512

    47b28d2020acc337cb529a073c9935493cc120eecc18acaa65d45510e3b4f3240b10bc22c0d7aeb584b6f5248cacd213aa44ca954c458f2b31fccc45e11aa8cd

  • SSDEEP

    6144:gI/HGKkMa0vPvde76MpBo/LiEy1n93AXiIKbUVgS1s/pqy0Lku9YAO5:gI/4Mah6MgU1n9HbKgvQRXA

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
    • C:\Users\Admin\AppData\Local\Temp\015445c335f7f72a0b76901c681f48a7.exe
      "C:\Users\Admin\AppData\Local\Temp\015445c335f7f72a0b76901c681f48a7.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:644

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/616-12-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/616-17-0x0000000026890000-0x00000000268A7000-memory.dmp

      Filesize

      92KB

    • memory/616-22-0x00000000268B0000-0x00000000268C7000-memory.dmp

      Filesize

      92KB

    • memory/616-27-0x00000000268D0000-0x00000000268E7000-memory.dmp

      Filesize

      92KB

    • memory/616-32-0x00000000268F0000-0x0000000026907000-memory.dmp

      Filesize

      92KB

    • memory/616-37-0x0000000026910000-0x0000000026927000-memory.dmp

      Filesize

      92KB

    • memory/616-42-0x0000000026930000-0x0000000026947000-memory.dmp

      Filesize

      92KB

    • memory/616-47-0x0000000026950000-0x0000000026967000-memory.dmp

      Filesize

      92KB

    • memory/616-52-0x0000000026970000-0x0000000026987000-memory.dmp

      Filesize

      92KB

    • memory/616-57-0x0000000026990000-0x00000000269A7000-memory.dmp

      Filesize

      92KB

    • memory/616-62-0x00000000269B0000-0x00000000269C7000-memory.dmp

      Filesize

      92KB

    • memory/616-72-0x00000000269F0000-0x0000000026A07000-memory.dmp

      Filesize

      92KB

    • memory/616-67-0x00000000269D0000-0x00000000269E7000-memory.dmp

      Filesize

      92KB

    • memory/616-82-0x0000000026A30000-0x0000000026A47000-memory.dmp

      Filesize

      92KB

    • memory/616-77-0x0000000026A10000-0x0000000026A27000-memory.dmp

      Filesize

      92KB

    • memory/616-87-0x0000000026A50000-0x0000000026A67000-memory.dmp

      Filesize

      92KB

    • memory/616-92-0x0000000026A70000-0x0000000026A87000-memory.dmp

      Filesize

      92KB

    • memory/616-97-0x0000000026A90000-0x0000000026AA7000-memory.dmp

      Filesize

      92KB

    • memory/616-102-0x0000000026AB0000-0x0000000026AC7000-memory.dmp

      Filesize

      92KB

    • memory/616-107-0x0000000026AD0000-0x0000000026AE7000-memory.dmp

      Filesize

      92KB

    • memory/616-112-0x0000000026AF0000-0x0000000026B07000-memory.dmp

      Filesize

      92KB

    • memory/616-117-0x0000000026B10000-0x0000000026B27000-memory.dmp

      Filesize

      92KB

    • memory/616-122-0x0000000026B30000-0x0000000026B47000-memory.dmp

      Filesize

      92KB

    • memory/616-127-0x0000000026B50000-0x0000000026B67000-memory.dmp

      Filesize

      92KB

    • memory/616-132-0x0000000026B70000-0x0000000026B87000-memory.dmp

      Filesize

      92KB

    • memory/616-137-0x0000000026B90000-0x0000000026BA7000-memory.dmp

      Filesize

      92KB

    • memory/616-142-0x0000000026BB0000-0x0000000026BC7000-memory.dmp

      Filesize

      92KB

    • memory/616-147-0x0000000026BD0000-0x0000000026BE7000-memory.dmp

      Filesize

      92KB

    • memory/616-152-0x0000000026BF0000-0x0000000026C07000-memory.dmp

      Filesize

      92KB

    • memory/616-157-0x0000000026C10000-0x0000000026C27000-memory.dmp

      Filesize

      92KB

    • memory/616-162-0x0000000026C30000-0x0000000026C47000-memory.dmp

      Filesize

      92KB

    • memory/616-167-0x0000000026C50000-0x0000000026C67000-memory.dmp

      Filesize

      92KB

    • memory/616-172-0x0000000026C70000-0x0000000026C87000-memory.dmp

      Filesize

      92KB

    • memory/616-177-0x0000000026C90000-0x0000000026CA7000-memory.dmp

      Filesize

      92KB

    • memory/616-182-0x0000000026CB0000-0x0000000026CC7000-memory.dmp

      Filesize

      92KB

    • memory/616-187-0x0000000026CD0000-0x0000000026CE7000-memory.dmp

      Filesize

      92KB

    • memory/616-192-0x0000000026CF0000-0x0000000026D07000-memory.dmp

      Filesize

      92KB

    • memory/616-197-0x0000000026D10000-0x0000000026D27000-memory.dmp

      Filesize

      92KB

    • memory/616-202-0x0000000026D30000-0x0000000026D47000-memory.dmp

      Filesize

      92KB

    • memory/616-207-0x0000000026D50000-0x0000000026D67000-memory.dmp

      Filesize

      92KB

    • memory/616-212-0x0000000026D70000-0x0000000026D87000-memory.dmp

      Filesize

      92KB

    • memory/616-217-0x0000000026D90000-0x0000000026DA7000-memory.dmp

      Filesize

      92KB

    • memory/616-222-0x0000000026DB0000-0x0000000026DC7000-memory.dmp

      Filesize

      92KB

    • memory/616-227-0x0000000026DD0000-0x0000000026DE7000-memory.dmp

      Filesize

      92KB

    • memory/616-232-0x0000000026DF0000-0x0000000026E07000-memory.dmp

      Filesize

      92KB

    • memory/616-237-0x0000000026E10000-0x0000000026E27000-memory.dmp

      Filesize

      92KB

    • memory/616-242-0x0000000026E30000-0x0000000026E47000-memory.dmp

      Filesize

      92KB

    • memory/616-247-0x0000000026E50000-0x0000000026E67000-memory.dmp

      Filesize

      92KB

    • memory/616-252-0x0000000026E70000-0x0000000026E87000-memory.dmp

      Filesize

      92KB

    • memory/616-257-0x0000000026E90000-0x0000000026EA7000-memory.dmp

      Filesize

      92KB

    • memory/616-262-0x0000000026EB0000-0x0000000026EC7000-memory.dmp

      Filesize

      92KB

    • memory/616-267-0x0000000026ED0000-0x0000000026EE7000-memory.dmp

      Filesize

      92KB

    • memory/616-272-0x0000000026EF0000-0x0000000026F07000-memory.dmp

      Filesize

      92KB

    • memory/616-277-0x0000000026F10000-0x0000000026F27000-memory.dmp

      Filesize

      92KB

    • memory/616-282-0x0000000026F30000-0x0000000026F47000-memory.dmp

      Filesize

      92KB

    • memory/616-287-0x0000000026F50000-0x0000000026F67000-memory.dmp

      Filesize

      92KB

    • memory/616-292-0x0000000026F70000-0x0000000026F87000-memory.dmp

      Filesize

      92KB

    • memory/616-297-0x0000000026F90000-0x0000000026FA7000-memory.dmp

      Filesize

      92KB

    • memory/616-302-0x0000000026FB0000-0x0000000026FC7000-memory.dmp

      Filesize

      92KB

    • memory/616-307-0x0000000026FD0000-0x0000000026FE7000-memory.dmp

      Filesize

      92KB

    • memory/616-312-0x0000000026FF0000-0x0000000027007000-memory.dmp

      Filesize

      92KB

    • memory/616-317-0x0000000027010000-0x0000000027027000-memory.dmp

      Filesize

      92KB

    • memory/616-322-0x0000000027030000-0x0000000027047000-memory.dmp

      Filesize

      92KB

    • memory/644-0-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/644-2-0x0000000000690000-0x00000000006A0000-memory.dmp

      Filesize

      64KB

    • memory/644-3-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/644-2605-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB