Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 03:48

General

  • Target

    Office 2010 Toolkit & EZ-Activator 2.0 Beta 3/Office 2010 Toolkit.exe

  • Size

    13.3MB

  • MD5

    801d7f317b7a067295bf4f8ea9dbf75f

  • SHA1

    d548ab079b6f7e119cb48ca614fb2e0ca9989fb5

  • SHA256

    3eb696008de29b3491c82e8c69b8382a7cb296a974a803b1f615f1d005b3be39

  • SHA512

    f737f0a8b1992650fb3d2965c57c1b36fee0920fae4d6f7ff156dee870cd0ff173ebfafd2f2fa18f2d4c179a7fa73ca88eaf9754f0a1c2f7a32dfaae935d1066

  • SSDEEP

    49152:HVDqgb7NC49ZD/SX1UFqQmNeLa1o3kYQHjOCAJ/Lsb63lqZGNml0Hgq30XhWpd:1D1DSN2UxAJDh3F

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Office 2010 Toolkit & EZ-Activator 2.0 Beta 3\Office 2010 Toolkit.exe
    "C:\Users\Admin\AppData\Local\Temp\Office 2010 Toolkit & EZ-Activator 2.0 Beta 3\Office 2010 Toolkit.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C schtasks /query /TN "AutoKMS"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\system32\schtasks.exe
        schtasks /query /TN "AutoKMS"
        3⤵
          PID:2952

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/652-0-0x00007FF996700000-0x00007FF9970A1000-memory.dmp

      Filesize

      9.6MB

    • memory/652-1-0x00007FF996700000-0x00007FF9970A1000-memory.dmp

      Filesize

      9.6MB

    • memory/652-3-0x000000001CEA0000-0x000000001D36E000-memory.dmp

      Filesize

      4.8MB

    • memory/652-4-0x000000001C7F0000-0x000000001C88C000-memory.dmp

      Filesize

      624KB

    • memory/652-2-0x0000000002030000-0x0000000002040000-memory.dmp

      Filesize

      64KB

    • memory/652-5-0x0000000002010000-0x0000000002018000-memory.dmp

      Filesize

      32KB

    • memory/652-6-0x000000001D650000-0x000000001D670000-memory.dmp

      Filesize

      128KB

    • memory/652-7-0x0000000002030000-0x0000000002040000-memory.dmp

      Filesize

      64KB

    • memory/652-8-0x00007FF996700000-0x00007FF9970A1000-memory.dmp

      Filesize

      9.6MB

    • memory/652-9-0x0000000002030000-0x0000000002040000-memory.dmp

      Filesize

      64KB

    • memory/652-11-0x00007FF996700000-0x00007FF9970A1000-memory.dmp

      Filesize

      9.6MB