Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 00:44

General

  • Target

    08f25af2c15de686932f61a4fe60d206.exe

  • Size

    29KB

  • MD5

    08f25af2c15de686932f61a4fe60d206

  • SHA1

    33963c77d471294635a7ad321e2e49521b3eb383

  • SHA256

    e1371b7ca6ff9bbbfb4bb56d3bd037ff261687a0218953d877066ffb6a2274ff

  • SHA512

    caf7e32c661e37635935fc8e0640f9b6cb3e88b72be013b645464260e5cad9521dd1a3baaf024321f5ab3bc069df2cfab9bb536be2f794fd5dd0410c2dfc67f3

  • SSDEEP

    768:jk7Ajy1o0J422hHbJHXevS+tzxNFa2AFagUGbzzn4Lgq:jc4xC2hH5XYS+ON517n4Eq

Score
8/10

Malware Config

Signatures

  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08f25af2c15de686932f61a4fe60d206.exe
    "C:\Users\Admin\AppData\Local\Temp\08f25af2c15de686932f61a4fe60d206.exe"
    1⤵
    • Sets file execution options in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\SysWOW64\cmd.exe
      cmd
      2⤵
        PID:1904
      • C:\Users\Admin\AppData\Local\Temp\~240632156.tmpe
        C:\Users\Admin\AppData\Local\Temp\~240632156.tmpe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\~240632156.tmpe

      Filesize

      7KB

      MD5

      826132c4b9f500a26274a8f589415b2d

      SHA1

      05f0990663ca2b31d8b320bccb57e721c4f3fdcf

      SHA256

      6e24832a7629050504c00b5ed93b0e78c37151352975b756d2a3365797ac695f

      SHA512

      57788e514695f82e6916fec3718e876813d79ec4137f4c43fcb28e47cd3f818285329ee90a5bc4d3a9d1534781f989f5e464cd02d51afbb6efcd728794f71c74

    • memory/2744-0-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2744-1-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2744-2-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2744-6-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

    • memory/2744-11-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB