Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 03:02
General
-
Target
0c64bc2a1c9496181e79c3aa75445b41.exe
-
Size
1.7MB
-
MD5
0c64bc2a1c9496181e79c3aa75445b41
-
SHA1
80fd654d987bc9dec2fc17e2a505167c7ca55e94
-
SHA256
5b210b801613f51262f0d2fcefdb5bfa57515b4b30cdced418eaf54a49c781d9
-
SHA512
7e140679b6fbd15f94773a661ac59f40e2aad9aadce40778ff4d05ad24923d5da578f04561731b7652019a41fcbf41367f3c958cce13ede34ea2fea322eac4a8
-
SSDEEP
49152:E6Puvkka04IgQcbGoCSw4EDnPiCLM3bhVPaS:8ZVLo2CF3b/
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe"C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB