Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 18:46

General

  • Target

    00dd7aeca01101a4a68b87dca6bb3617.exe

  • Size

    9KB

  • MD5

    00dd7aeca01101a4a68b87dca6bb3617

  • SHA1

    26167a2354c5478f227b2d98ddf90b65f8f22c1e

  • SHA256

    6cc2fdcdbe4fb574bb3d655f066b82bcc321852f4084ba573091a23b6eb47d57

  • SHA512

    e111913dbac847a74d99468314d1ba5938b027359d9fdcb863a8652e23ba09162ac8363e74cc20ef626585f487c54d3a7e6dd3f5d1ad73396c0175860842ac07

  • SSDEEP

    192:4BksuLPY82gQv5F4Xt6eMZZ3H93VnjdwCzTh3W+7lF:o82l4Xt6eMhFnhwC/hmol

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00dd7aeca01101a4a68b87dca6bb3617.exe
    "C:\Users\Admin\AppData\Local\Temp\00dd7aeca01101a4a68b87dca6bb3617.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1476-0-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

    Filesize

    32KB

  • memory/1476-1-0x00007FFDA4F70000-0x00007FFDA5A31000-memory.dmp

    Filesize

    10.8MB

  • memory/1476-2-0x0000000002E20000-0x0000000002E32000-memory.dmp

    Filesize

    72KB

  • memory/1476-3-0x000000001B7B0000-0x000000001B7EC000-memory.dmp

    Filesize

    240KB

  • memory/1476-4-0x00007FFDA4F70000-0x00007FFDA5A31000-memory.dmp

    Filesize

    10.8MB

  • memory/1476-5-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

    Filesize

    64KB

  • memory/1476-6-0x000000001BAE0000-0x000000001BAF0000-memory.dmp

    Filesize

    64KB

  • memory/1476-7-0x00007FFDA4F70000-0x00007FFDA5A31000-memory.dmp

    Filesize

    10.8MB