Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 12:55
General
-
Target
36e757339da0f68b1022a0897edb0791.exe
-
Size
57KB
-
MD5
36e757339da0f68b1022a0897edb0791
-
SHA1
b7e0a9c8d01c6f2830afa96851ea1880d11b7e1a
-
SHA256
5d5bf05d8607f7fccfbf7c5942f24abad1f42aec2b868b2828fb8a18ce7d2c61
-
SHA512
504924ff7a757a2be2c5ccf434602c2da078e5c11ced15a85b8fd5cdcbfd28c0022703495b90eb82584c14ac5ae148b2afa256884e1ce433ca2ab1bf24afaf84
-
SSDEEP
768:TkxciUrur/C3uYAKWKxFPpMxiebCEda04KmMcCAznCRh2y:Tkxcive5pWKxEsepF4KpcCAG72y
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e757339da0f68b1022a0897edb0791.exe"C:\Users\Admin\AppData\Local\Temp\36e757339da0f68b1022a0897edb0791.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB