Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 20:42

General

  • Target

    03737b0acc09c43872f87b72f8a48108.exe

  • Size

    277KB

  • MD5

    03737b0acc09c43872f87b72f8a48108

  • SHA1

    36b6ac40d57ae7ecb5753d5b43fc58e4a7fa7109

  • SHA256

    7dfaf7dcb5e4a600c2dde4f2627dda36a2e5afdf8c41d077a9eeb2ca8a40bc93

  • SHA512

    3c0753e763ed94a153953d760079a315bee00f21de5f906400afa8aa748d2c57056db72fb1c9668e4bea92e0412b5c3fe0e7dda78cccaebd8270dd1e1d727b27

  • SSDEEP

    6144:aV1VjlMindSC/xSAZ21ICSFjmf9fWDCxS2K0naW+tIqlnlkka:a1jlMiSGxBUVSFmf9fx2G4eu6r

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03737b0acc09c43872f87b72f8a48108.exe
    "C:\Users\Admin\AppData\Local\Temp\03737b0acc09c43872f87b72f8a48108.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2812-0-0x0000000002300000-0x0000000002367000-memory.dmp

    Filesize

    412KB

  • memory/2812-1-0x0000000000400000-0x0000000000555000-memory.dmp

    Filesize

    1.3MB

  • memory/2812-3-0x00000000027D0000-0x0000000002882000-memory.dmp

    Filesize

    712KB

  • memory/2812-4-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-6-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-7-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-10-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-9-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-65-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-66-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-74-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-79-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-82-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-86-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-89-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-92-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-94-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-96-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-100-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-102-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-108-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-110-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-113-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-115-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-119-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-111-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-109-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-106-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-107-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-105-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-101-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-98-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-88-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-84-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-72-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-71-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-70-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-69-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-68-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-67-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-64-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-63-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB

  • memory/2812-1089-0x0000000002300000-0x0000000002367000-memory.dmp

    Filesize

    412KB

  • memory/2812-1325-0x0000000000400000-0x0000000000555000-memory.dmp

    Filesize

    1.3MB

  • memory/2812-1604-0x0000000002990000-0x0000000002A48000-memory.dmp

    Filesize

    736KB