Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 10:36
General
-
Target
17a68c6145e3cd2238e420b19caa96f3.exe
-
Size
852KB
-
MD5
17a68c6145e3cd2238e420b19caa96f3
-
SHA1
ffcb7eff513542242100a871db1a4105f952259a
-
SHA256
4bd95b1d347ffcb27b10ca7178fd9408f25b101dc5f3d9ddcffce3ddbb1ea634
-
SHA512
c610cc475f96866ea660929d5e6237e67eced67a1f8a1bee2cd7dd4464b4103caedb8401f0233d12aa496748886c5df6331fd29af0b5af69587f1a0f0e4268bd
-
SSDEEP
12288:n2fsSv2g+MPsC3oKKE9fDhQVE2VEoH6H35pSJ6u4HiEaNX9f9N340uxb16:nFjg+Wp3oKKEdNO9lapxCPD3q36
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a68c6145e3cd2238e420b19caa96f3.exe"C:\Users\Admin\AppData\Local\Temp\17a68c6145e3cd2238e420b19caa96f3.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec 0x4781⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
-
Filesize
880KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
10.8MB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB