Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 19:06
General
-
Target
36a10a71558e65232baf892bfe79e9dc.exe
-
Size
1.1MB
-
MD5
36a10a71558e65232baf892bfe79e9dc
-
SHA1
0512969156c72b918cb9b8931fdcf34e1b04a590
-
SHA256
e0f9f9b4f3ace0b4e70f28c64a282675ca9824d0dff4c33e6126e16d5ee91178
-
SHA512
9b3d5c7270d8144cae4487f285d8310672f7e624cacd160ebd282461e772721a7ea18fefb02f55a013de1f3d17649fe73ccbc77c1c70865a385b686c9e656287
-
SSDEEP
12288:mnKgOsc+Cza/okeLjSl0r7EMydtUiJgduTNgE4PoE6dSgwByaS0Ep6Rxnn2DJlBT:sLc+vxEBfBPojSbByIwCtn+l5jA
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36a10a71558e65232baf892bfe79e9dc.exe"C:\Users\Admin\AppData\Local\Temp\36a10a71558e65232baf892bfe79e9dc.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88B
MD58657457edec3e1d7b1310a8bba96cb16
SHA1014e7334822fc693e6faecf67dec2a6723d4f0a8
SHA25608bba35ce0d487b5a046c95c447d30b9909e56f76ac18487593a9026a4daf32f
SHA512c81127f3ec2dbe8d92d3d0f8de0bd6dcbfc4db122667b4d6d84ee5315d01378cddc35d6d6ef557427c15b66cf2f5dc5d8fcef868d690b6ba6b6334d9980b48d3
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB