Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 02:04

General

  • Target

    0b0939137b56861d30c02bf8c2a42f1c.exe

  • Size

    1.7MB

  • MD5

    0b0939137b56861d30c02bf8c2a42f1c

  • SHA1

    3e8a26ed1653394676db7f104ea2d97b0053e160

  • SHA256

    8175eb3085d209a982720c69d1880234ac26b58e90713eeebaa971c6ef195eb4

  • SHA512

    4b39940c3a0c95273028e83bec80148a2957556dfd45527e24e750fa2d395b3b886ed22e295291330895475800f030238a8953f4926a0a8aba3f6409343a44b6

  • SSDEEP

    24576:kgSivRpANHygPunq/n+uIMHvEJoAofl7giPK9AErPV/AHYc6Nw+geqapYP+VyoEz:k3SgbvhIq8CZg0pIDQ+oMFBCv7Z

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b0939137b56861d30c02bf8c2a42f1c.exe
    "C:\Users\Admin\AppData\Local\Temp\0b0939137b56861d30c02bf8c2a42f1c.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3744-0-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-1-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-2-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-4-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-114-0x0000000002A20000-0x0000000002A23000-memory.dmp

    Filesize

    12KB

  • memory/3744-840-0x00000000029B0000-0x00000000029FB000-memory.dmp

    Filesize

    300KB

  • memory/3744-523-0x0000000002A10000-0x0000000002A17000-memory.dmp

    Filesize

    28KB

  • memory/3744-1028-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/3744-5-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-3-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-1044-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-1045-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-1046-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-1047-0x0000000000400000-0x00000000009DC832-memory.dmp

    Filesize

    5.9MB

  • memory/3744-1048-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB