Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 18:25

General

  • Target

    0061a1551ef63e2d130148bf01cb12b2.exe

  • Size

    517KB

  • MD5

    0061a1551ef63e2d130148bf01cb12b2

  • SHA1

    61c557b998189e1eb7c009ac6b82ac1d59c37e8f

  • SHA256

    cff0ba7d0d7e13a478b65e3968fe7bfb5b826a29856d90c81d8f519622a8c7a1

  • SHA512

    de1010680a739c7ee26118f8d5d12ba67265dfa73f19fbdf1dc838dd44e700a753c8b688166f00d226132291a49a0b1a882103469047f2ff7a83b6fb78fd6800

  • SSDEEP

    12288:S9xJoNTT5XX8p5GNOc09ZXArdiRO3pVCxcNna7VaXC5:S9xsHZYuF09ZXAro43pVCq9aJd5

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:628
    • C:\Users\Admin\AppData\Local\Temp\0061a1551ef63e2d130148bf01cb12b2.exe
      "C:\Users\Admin\AppData\Local\Temp\0061a1551ef63e2d130148bf01cb12b2.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/628-10-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/628-15-0x000000002FD20000-0x000000002FD37000-memory.dmp

      Filesize

      92KB

    • memory/628-20-0x000000002FD40000-0x000000002FD57000-memory.dmp

      Filesize

      92KB

    • memory/628-25-0x000000002FD60000-0x000000002FD77000-memory.dmp

      Filesize

      92KB

    • memory/628-30-0x000000002FD80000-0x000000002FD97000-memory.dmp

      Filesize

      92KB

    • memory/628-35-0x000000002FDA0000-0x000000002FDB7000-memory.dmp

      Filesize

      92KB

    • memory/628-40-0x000000002FDC0000-0x000000002FDD7000-memory.dmp

      Filesize

      92KB

    • memory/628-45-0x000000002FDE0000-0x000000002FDF7000-memory.dmp

      Filesize

      92KB

    • memory/628-50-0x000000002FE00000-0x000000002FE17000-memory.dmp

      Filesize

      92KB

    • memory/628-55-0x000000002FE20000-0x000000002FE37000-memory.dmp

      Filesize

      92KB

    • memory/628-60-0x000000002FE40000-0x000000002FE57000-memory.dmp

      Filesize

      92KB

    • memory/628-65-0x000000002FE60000-0x000000002FE77000-memory.dmp

      Filesize

      92KB

    • memory/628-70-0x000000002FE80000-0x000000002FE97000-memory.dmp

      Filesize

      92KB

    • memory/628-75-0x000000002FEA0000-0x000000002FEB7000-memory.dmp

      Filesize

      92KB

    • memory/628-80-0x000000002FEC0000-0x000000002FED7000-memory.dmp

      Filesize

      92KB

    • memory/628-85-0x000000002FEE0000-0x000000002FEF7000-memory.dmp

      Filesize

      92KB

    • memory/628-90-0x000000002FF00000-0x000000002FF17000-memory.dmp

      Filesize

      92KB

    • memory/628-95-0x000000002FF20000-0x000000002FF37000-memory.dmp

      Filesize

      92KB

    • memory/628-100-0x000000002FF40000-0x000000002FF57000-memory.dmp

      Filesize

      92KB

    • memory/628-105-0x000000002FF60000-0x000000002FF77000-memory.dmp

      Filesize

      92KB

    • memory/628-110-0x000000002FF80000-0x000000002FF97000-memory.dmp

      Filesize

      92KB

    • memory/628-115-0x000000002FFA0000-0x000000002FFB7000-memory.dmp

      Filesize

      92KB

    • memory/628-120-0x000000002FFC0000-0x000000002FFD7000-memory.dmp

      Filesize

      92KB

    • memory/628-125-0x000000002FFE0000-0x000000002FFF7000-memory.dmp

      Filesize

      92KB

    • memory/628-130-0x0000000030000000-0x0000000030017000-memory.dmp

      Filesize

      92KB

    • memory/628-135-0x0000000030020000-0x0000000030037000-memory.dmp

      Filesize

      92KB

    • memory/628-140-0x0000000030040000-0x0000000030057000-memory.dmp

      Filesize

      92KB

    • memory/628-145-0x0000000030060000-0x0000000030077000-memory.dmp

      Filesize

      92KB

    • memory/628-150-0x0000000030080000-0x0000000030097000-memory.dmp

      Filesize

      92KB

    • memory/628-155-0x00000000300A0000-0x00000000300B7000-memory.dmp

      Filesize

      92KB

    • memory/628-160-0x00000000300C0000-0x00000000300D7000-memory.dmp

      Filesize

      92KB

    • memory/628-165-0x00000000300E0000-0x00000000300F7000-memory.dmp

      Filesize

      92KB

    • memory/628-170-0x0000000030100000-0x0000000030117000-memory.dmp

      Filesize

      92KB

    • memory/628-175-0x0000000030120000-0x0000000030137000-memory.dmp

      Filesize

      92KB

    • memory/628-180-0x0000000030140000-0x0000000030157000-memory.dmp

      Filesize

      92KB

    • memory/628-185-0x0000000030160000-0x0000000030177000-memory.dmp

      Filesize

      92KB

    • memory/628-190-0x0000000030180000-0x0000000030197000-memory.dmp

      Filesize

      92KB

    • memory/628-195-0x00000000301A0000-0x00000000301B7000-memory.dmp

      Filesize

      92KB

    • memory/628-200-0x00000000301C0000-0x00000000301D7000-memory.dmp

      Filesize

      92KB

    • memory/628-205-0x00000000301E0000-0x00000000301F7000-memory.dmp

      Filesize

      92KB

    • memory/628-210-0x0000000030200000-0x0000000030217000-memory.dmp

      Filesize

      92KB

    • memory/628-215-0x0000000030220000-0x0000000030237000-memory.dmp

      Filesize

      92KB

    • memory/628-220-0x0000000030240000-0x0000000030257000-memory.dmp

      Filesize

      92KB

    • memory/628-225-0x0000000030260000-0x0000000030277000-memory.dmp

      Filesize

      92KB

    • memory/628-230-0x0000000030280000-0x0000000030297000-memory.dmp

      Filesize

      92KB

    • memory/628-235-0x00000000302A0000-0x00000000302B7000-memory.dmp

      Filesize

      92KB

    • memory/628-240-0x00000000302C0000-0x00000000302D7000-memory.dmp

      Filesize

      92KB

    • memory/628-245-0x00000000302E0000-0x00000000302F7000-memory.dmp

      Filesize

      92KB

    • memory/628-250-0x0000000030300000-0x0000000030317000-memory.dmp

      Filesize

      92KB

    • memory/628-255-0x0000000030320000-0x0000000030337000-memory.dmp

      Filesize

      92KB

    • memory/628-260-0x0000000030340000-0x0000000030357000-memory.dmp

      Filesize

      92KB

    • memory/628-265-0x0000000030360000-0x0000000030377000-memory.dmp

      Filesize

      92KB

    • memory/628-270-0x0000000030380000-0x0000000030397000-memory.dmp

      Filesize

      92KB

    • memory/628-275-0x00000000303A0000-0x00000000303B7000-memory.dmp

      Filesize

      92KB

    • memory/628-280-0x00000000303C0000-0x00000000303D7000-memory.dmp

      Filesize

      92KB

    • memory/628-285-0x00000000303E0000-0x00000000303F7000-memory.dmp

      Filesize

      92KB

    • memory/628-290-0x0000000030400000-0x0000000030417000-memory.dmp

      Filesize

      92KB

    • memory/628-295-0x0000000030420000-0x0000000030437000-memory.dmp

      Filesize

      92KB

    • memory/628-300-0x0000000030440000-0x0000000030457000-memory.dmp

      Filesize

      92KB

    • memory/628-305-0x0000000030460000-0x0000000030477000-memory.dmp

      Filesize

      92KB

    • memory/628-310-0x0000000030480000-0x0000000030497000-memory.dmp

      Filesize

      92KB

    • memory/628-315-0x00000000304A0000-0x00000000304B7000-memory.dmp

      Filesize

      92KB

    • memory/628-320-0x00000000304C0000-0x00000000304D7000-memory.dmp

      Filesize

      92KB

    • memory/4968-0-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/4968-1-0x00000000001C0000-0x00000000001D0000-memory.dmp

      Filesize

      64KB