Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 04:32
General
-
Target
54695921cba45873f83abd20fd48fe44.exe
-
Size
2.3MB
-
MD5
54695921cba45873f83abd20fd48fe44
-
SHA1
efbb580af2e686d2470f239a6688a18c89910e98
-
SHA256
71f8d67454fc5341f12bb1f2a9f1f9dafd867ee53d2dde42e2979697f952d05f
-
SHA512
9b283288af0de4db8593a557d67486f4b7d2af90bf0d8c22f55d61c82e4e1c222bf675d447c62a644c30e847b682eb6c740325cbb0a7f829e300ebe903549e22
-
SSDEEP
49152:/4EDgkyNw8yhyiwn9QUQi2QOPiSBUuhIKnNpaYZ6u4v3nt4zm/DBFHqAYAyYjrn:QEDgVNNL9QUQiePPTnLa06xv3nZDBZqO
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54695921cba45873f83abd20fd48fe44.exe"C:\Users\Admin\AppData\Local\Temp\54695921cba45873f83abd20fd48fe44.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
\??\c:\TITI.EXEc:\TITI.EXE /nogui c:\kill.txt2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714KB
MD530f3680e007d924960fd65524de36601
SHA123f1e67e28052188432d2031335a79cb5ae72a8f
SHA2566485271fe48f7be4cb49735c60fa4cf2ff52f235e2b24bfba22df6ea75fda1d7
SHA51233323b60353430962ef0e07dd166625ae8cb1d2080f75859d35cf0c807d146ccd7272feef37ebbe8ce77f988658ef0dee6602f9b1bcf429cd0c1898862b5091a
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
2.7MB
-
Filesize
2.7MB