Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 18:35

General

  • Target

    009b52b3f66bb04759acaa338848ee1f.exe

  • Size

    334KB

  • MD5

    009b52b3f66bb04759acaa338848ee1f

  • SHA1

    d507ed9078a8927aa05cf62e2b9a23ab8b74ef3a

  • SHA256

    242f7b16040cc284654930e872c7dddb7b5a4640fba0de42669a8c9ef321598b

  • SHA512

    5da9e91bb96a6b1fc6ea069e444851b62541255973e5e290c1c9e376c12f683da3f4514669b00eac4c61fbac46e6ca4c936667dff338d93d7eb09a2abf5f0428

  • SSDEEP

    6144:MnyswfWCVUP89jgiqUP8tucUpCL/W1qQmMJZRESeGuz3V8AbtQJYr:MyJfzVj9PqUozi2W1vmWZRbim+

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\009b52b3f66bb04759acaa338848ee1f.exe
    "C:\Users\Admin\AppData\Local\Temp\009b52b3f66bb04759acaa338848ee1f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bhsD07F.tmp

    Filesize

    259KB

    MD5

    6079171ee93812a5b89afa3a92f6fee3

    SHA1

    7662e979b2c6b042af377f757a84ab6e87d72351

    SHA256

    978ada3bdbdc831f9a48db57e8c2085f651106b5402c90b6017787dc454e12dc

    SHA512

    2d7af0d0db257bd7c1c0a35296c642c7ccba2a4515fdc17e55f6bf11730f1feacd761aef710e300d0d58879f759cf984ec97f148acb91998e1ce998f7240d06d

  • memory/3796-7-0x0000000006D80000-0x0000000006D8A000-memory.dmp

    Filesize

    40KB

  • memory/3796-3-0x0000000004A20000-0x0000000004A66000-memory.dmp

    Filesize

    280KB

  • memory/3796-4-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

    Filesize

    64KB

  • memory/3796-5-0x0000000007280000-0x0000000007824000-memory.dmp

    Filesize

    5.6MB

  • memory/3796-6-0x0000000006CD0000-0x0000000006D62000-memory.dmp

    Filesize

    584KB

  • memory/3796-0-0x0000000074570000-0x0000000074D20000-memory.dmp

    Filesize

    7.7MB

  • memory/3796-8-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

    Filesize

    64KB

  • memory/3796-9-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

    Filesize

    64KB

  • memory/3796-10-0x0000000009C40000-0x0000000009CA6000-memory.dmp

    Filesize

    408KB

  • memory/3796-19-0x0000000074570000-0x0000000074D20000-memory.dmp

    Filesize

    7.7MB

  • memory/3796-20-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

    Filesize

    64KB

  • memory/3796-21-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

    Filesize

    64KB

  • memory/3796-22-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

    Filesize

    64KB