Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
WebCracker路由密码暴力破解工具 v4.0 绿色特别版下载/WebCrack4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
WebCracker路由密码暴力破解工具 v4.0 绿色特别版下载/WebCrack4.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
WebCracker路由密码暴力破解工具 v4.0 绿色特别版下载/superdic.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
WebCracker路由密码暴力破解工具 v4.0 绿色特别版下载/superdic.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
readme.url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
readme.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
下载王www.xzking.com.url
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
下载王www.xzking.com.url
Resource
win10v2004-20231222-en
General
-
Target
WebCracker路由密码暴力破解工具 v4.0 绿色特别版下载/WebCrack4.exe
-
Size
1.5MB
-
MD5
b50b46ab225da8ba7eeb934bfcbe7390
-
SHA1
00c68d1b1aa655dfd5bb693c13cdda9dbd34c638
-
SHA256
d6672c2d47218c2cabba5ba8a4623d9be16fafa91bd14b7a4dfda38032621cbe
-
SHA512
3621ff2716c64e02a21747e0936c297fef35b9c379ec1ac1de22fae814c801dd988032cf9202537bf05ca81b957f0cd1e4ea011e235b88b8a49ec8f13acc774c
-
SSDEEP
24576:ftvST6vE3RMlEYPoprnbLVfCHwI/fpN+Qz/n0QZ:FST6vEYPKLVfC/HpkQz/n0Q
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1680 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1680 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\WebCracker路由密码暴力破解工具 v4.0 绿色特别版下载\WebCrack4.exe"C:\Users\Admin\AppData\Local\Temp\WebCracker路由密码暴力破解工具 v4.0 绿色特别版下载\WebCrack4.exe"1⤵PID:5056
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x510 0x5081⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680