Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 01:21
General
-
Target
SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12415.23003.exe
-
Size
4.7MB
-
MD5
7db918e235c3f239b6d99e68e8dac93c
-
SHA1
e6f607d356166edf3f044afd340845f5bf255d4c
-
SHA256
cd7f3e7bc9f55c0018b0db329c5fdaf13e2e295cf10eee13c8b580f47e871e1c
-
SHA512
7b2f0324605a5a13cd7e3a5b0729220ff7cfea336172aeca09b867053c9910c165e5d4f828939544bf0e007310ab122974edeab4c5d4cc626c914b789ec344f9
-
SSDEEP
98304:Q529odJEHJswzNf9edrWiAz7CTfE8LnOI07AViGY23+w482mjgWcH8o4dm8:AduH3f98C5vqy7lBg4Nmjg1H8o4dD
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 51 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12415.23003.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12415.23003.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2J7OU.tmp\SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12415.23003.tmp"C:\Users\Admin\AppData\Local\Temp\is-2J7OU.tmp\SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12415.23003.tmp" /SL5="$8011E,4660056,54272,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-Dropper.Win32.Agent.12415.23003.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\JSON Stdandart API\jsonstdapi.exe"C:\Program Files (x86)\JSON Stdandart API\jsonstdapi.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\JSON Stdandart API\jsonstdapi.exe"C:\Program Files (x86)\JSON Stdandart API\jsonstdapi.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 303⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 301⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD56a3dd53ba7c28000750f604133b072cc
SHA1d0c20f11b02fbdce077bdd68520a78801c6f75d7
SHA256b11b4b425f2b1f0469bcce0c308b91cc0fb955becd26f1fc26ec8c405f2f04e5
SHA512465f90dff2170b5ae61fccf9538a9fb713d08cb521ce124c4dfe48b7a8e0ece8f84f09e61a59d0e5d88f451683bf1eb7af9a7c280a589cc1f6e07c1e73696514
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
648KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB