Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    174s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 21:07

General

  • Target

    040c29f2e1ddd52b5d3d82342be5c054.exe

  • Size

    53KB

  • MD5

    040c29f2e1ddd52b5d3d82342be5c054

  • SHA1

    cef679049cee05ef4af8ca5c38bf178d3d9f9b51

  • SHA256

    46fe68cfcc069a984cdc39beb9a8e6a5ff07f23281efffb7d09e9b95d0246840

  • SHA512

    c50f839bb29ff5a9b7f696fbc2ad5b06633a18736ecbc6513134effc5b4c4ed4fb1623a4618a2c218d99da1741776991328a1a5b13079c5b5dd857cca3eddf3a

  • SSDEEP

    1536:FVfNQv25QsT3RNGx8Z062GS+86kaYKRPdBIxyIGWjWSOP:FVp5QubL0DGS+vbRlBtV5

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
    • C:\Users\Admin\AppData\Local\Temp\040c29f2e1ddd52b5d3d82342be5c054.exe
      "C:\Users\Admin\AppData\Local\Temp\040c29f2e1ddd52b5d3d82342be5c054.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4396

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/612-12-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/612-17-0x000000000A9E0000-0x000000000AA08000-memory.dmp

      Filesize

      160KB

    • memory/612-22-0x000000000AA10000-0x000000000AA38000-memory.dmp

      Filesize

      160KB

    • memory/612-27-0x000000000AA40000-0x000000000AA68000-memory.dmp

      Filesize

      160KB

    • memory/612-32-0x000000000AA70000-0x000000000AA98000-memory.dmp

      Filesize

      160KB

    • memory/612-37-0x000000000AAA0000-0x000000000AAC8000-memory.dmp

      Filesize

      160KB

    • memory/612-42-0x000000000AAD0000-0x000000000AAF8000-memory.dmp

      Filesize

      160KB

    • memory/612-47-0x000000000AB00000-0x000000000AB28000-memory.dmp

      Filesize

      160KB

    • memory/612-52-0x000000000AB30000-0x000000000AB58000-memory.dmp

      Filesize

      160KB

    • memory/612-57-0x000000000AB60000-0x000000000AB88000-memory.dmp

      Filesize

      160KB

    • memory/612-62-0x000000000AB90000-0x000000000ABB8000-memory.dmp

      Filesize

      160KB

    • memory/612-67-0x000000000ABC0000-0x000000000ABE8000-memory.dmp

      Filesize

      160KB

    • memory/612-72-0x000000000ABF0000-0x000000000AC18000-memory.dmp

      Filesize

      160KB

    • memory/612-77-0x000000000AC20000-0x000000000AC48000-memory.dmp

      Filesize

      160KB

    • memory/612-82-0x000000000AC50000-0x000000000AC78000-memory.dmp

      Filesize

      160KB

    • memory/612-87-0x000000000AC80000-0x000000000ACA8000-memory.dmp

      Filesize

      160KB

    • memory/612-92-0x000000000ACB0000-0x000000000ACD8000-memory.dmp

      Filesize

      160KB

    • memory/612-97-0x000000000ACE0000-0x000000000AD08000-memory.dmp

      Filesize

      160KB

    • memory/612-102-0x000000000AD10000-0x000000000AD38000-memory.dmp

      Filesize

      160KB

    • memory/612-107-0x000000000AD40000-0x000000000AD68000-memory.dmp

      Filesize

      160KB

    • memory/612-112-0x000000000AD70000-0x000000000AD98000-memory.dmp

      Filesize

      160KB

    • memory/612-117-0x000000000ADA0000-0x000000000ADC8000-memory.dmp

      Filesize

      160KB

    • memory/612-122-0x000000000ADD0000-0x000000000ADF8000-memory.dmp

      Filesize

      160KB

    • memory/612-127-0x000000000AE00000-0x000000000AE28000-memory.dmp

      Filesize

      160KB

    • memory/612-132-0x000000000AE30000-0x000000000AE58000-memory.dmp

      Filesize

      160KB

    • memory/612-137-0x000000000AE60000-0x000000000AE88000-memory.dmp

      Filesize

      160KB

    • memory/612-142-0x000000000AE90000-0x000000000AEB8000-memory.dmp

      Filesize

      160KB

    • memory/612-147-0x000000000AEC0000-0x000000000AEE8000-memory.dmp

      Filesize

      160KB

    • memory/612-152-0x000000000AEF0000-0x000000000AF18000-memory.dmp

      Filesize

      160KB

    • memory/612-157-0x000000000AF20000-0x000000000AF48000-memory.dmp

      Filesize

      160KB

    • memory/612-162-0x000000000AF50000-0x000000000AF78000-memory.dmp

      Filesize

      160KB

    • memory/612-167-0x000000000AF80000-0x000000000AFA8000-memory.dmp

      Filesize

      160KB

    • memory/612-172-0x000000000AFB0000-0x000000000AFD8000-memory.dmp

      Filesize

      160KB

    • memory/612-177-0x000000000AFE0000-0x000000000B008000-memory.dmp

      Filesize

      160KB

    • memory/612-182-0x000000000B010000-0x000000000B038000-memory.dmp

      Filesize

      160KB

    • memory/612-187-0x000000000B040000-0x000000000B068000-memory.dmp

      Filesize

      160KB

    • memory/612-192-0x000000000B070000-0x000000000B098000-memory.dmp

      Filesize

      160KB

    • memory/612-197-0x000000000B0A0000-0x000000000B0C8000-memory.dmp

      Filesize

      160KB

    • memory/612-202-0x000000000B0D0000-0x000000000B0F8000-memory.dmp

      Filesize

      160KB

    • memory/612-207-0x000000000B100000-0x000000000B128000-memory.dmp

      Filesize

      160KB

    • memory/612-212-0x000000000B130000-0x000000000B158000-memory.dmp

      Filesize

      160KB

    • memory/612-217-0x000000000B160000-0x000000000B188000-memory.dmp

      Filesize

      160KB

    • memory/612-222-0x000000000B190000-0x000000000B1B8000-memory.dmp

      Filesize

      160KB

    • memory/612-227-0x000000000B1C0000-0x000000000B1E8000-memory.dmp

      Filesize

      160KB

    • memory/612-232-0x000000000B1F0000-0x000000000B218000-memory.dmp

      Filesize

      160KB

    • memory/612-237-0x000000000B220000-0x000000000B248000-memory.dmp

      Filesize

      160KB

    • memory/612-242-0x000000000B250000-0x000000000B278000-memory.dmp

      Filesize

      160KB

    • memory/612-247-0x000000000B280000-0x000000000B2A8000-memory.dmp

      Filesize

      160KB

    • memory/612-252-0x000000000B2B0000-0x000000000B2D8000-memory.dmp

      Filesize

      160KB

    • memory/612-257-0x000000000B2E0000-0x000000000B308000-memory.dmp

      Filesize

      160KB

    • memory/612-262-0x000000000B310000-0x000000000B338000-memory.dmp

      Filesize

      160KB

    • memory/612-267-0x000000000B340000-0x000000000B368000-memory.dmp

      Filesize

      160KB

    • memory/612-272-0x000000000B370000-0x000000000B398000-memory.dmp

      Filesize

      160KB

    • memory/612-277-0x000000000B3A0000-0x000000000B3C8000-memory.dmp

      Filesize

      160KB

    • memory/612-282-0x000000000B3D0000-0x000000000B3F8000-memory.dmp

      Filesize

      160KB

    • memory/612-287-0x000000000B400000-0x000000000B428000-memory.dmp

      Filesize

      160KB

    • memory/612-292-0x000000000B430000-0x000000000B458000-memory.dmp

      Filesize

      160KB

    • memory/612-297-0x000000000B460000-0x000000000B488000-memory.dmp

      Filesize

      160KB

    • memory/612-302-0x000000000B490000-0x000000000B4B8000-memory.dmp

      Filesize

      160KB

    • memory/612-307-0x000000000B4C0000-0x000000000B4E8000-memory.dmp

      Filesize

      160KB

    • memory/612-312-0x000000000B4F0000-0x000000000B518000-memory.dmp

      Filesize

      160KB

    • memory/612-317-0x000000000B520000-0x000000000B548000-memory.dmp

      Filesize

      160KB

    • memory/4396-0-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4396-1-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4396-2-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4396-3-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB