Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 02:52
General
-
Target
253d09978322865776341262fb6faa61.exe
-
Size
164KB
-
MD5
253d09978322865776341262fb6faa61
-
SHA1
76163271afb7497a0f47ba78553cc8dfa5ec9f4b
-
SHA256
fdbd3303441f7c9824396c4ddb6264985e222b03f7c81461437bd1f91bf22452
-
SHA512
c0f1093a82907ce7ffb3c8e5922d4a1931b4ad724b42c993714d540720aa05c9f008ab04c82fcdec66173a94a89800a185cd9b1f7e132146210a1b6e922c2266
-
SSDEEP
3072:vecfyc98W/w3w4wTDQo6vEaZ97fwjwNGL9w0LTGXgY6/4WtG9dqAg4dJ2RlDEY:vecfx98W/wgB0vEa/zGCGCXM4UOdqjE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\253d09978322865776341262fb6faa61.exe"C:\Users\Admin\AppData\Local\Temp\253d09978322865776341262fb6faa61.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logon.comC:\Windows\system32\logon.com2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5253d09978322865776341262fb6faa61
SHA176163271afb7497a0f47ba78553cc8dfa5ec9f4b
SHA256fdbd3303441f7c9824396c4ddb6264985e222b03f7c81461437bd1f91bf22452
SHA512c0f1093a82907ce7ffb3c8e5922d4a1931b4ad724b42c993714d540720aa05c9f008ab04c82fcdec66173a94a89800a185cd9b1f7e132146210a1b6e922c2266
-
Filesize
8KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
8KB
-
Filesize
656KB
-
Filesize
8KB
-
Filesize
656KB
-
Filesize
4KB
-
Filesize
656KB