Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/01/2024, 12:31
General
-
Target
3cdd56ad474ebef40f70b209d6bb5415.exe
-
Size
300KB
-
MD5
3cdd56ad474ebef40f70b209d6bb5415
-
SHA1
7f03cfa41b6abe440738a2c824b67b1ec16c7205
-
SHA256
8dc8690323b9905db8c8b68d47287ca9aa6c1c3793afd882e085da5020d9b7c2
-
SHA512
b925fe7e3bacac9042636fd6fb5bf57d90aa17847d88caf6a7edc411f759178d225c8d0da0c13a380892cc888ebe46608a4eb21c3925746905c1df4fa466bb2a
-
SSDEEP
6144:lxcGs0RLkFpzB/Zz92IzuSqVkATxeBVmLotzbE3r9yDQvM:BRLkfzBRR2+akFvmLot/E3g80
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cdd56ad474ebef40f70b209d6bb5415.exe"C:\Users\Admin\AppData\Local\Temp\3cdd56ad474ebef40f70b209d6bb5415.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\240601906.bat2⤵
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD501f2230eb5932e04c0301a68022b9d66
SHA10faa87b293dd9de73cb1f10027a846c14e8d096d
SHA25608fa122e85125f0ae4ffdbfacc22d3bbad4368f2e79ab6c2f9cb11181decaa6b
SHA51263608bc00c2c8bd17aba73f6dce0922ab71436ccc95232987fb86bdb35e4b1ceda241de54f5f6eaa725431b0249f19a9cba88a00eb131c6ad3344f157c4fd813
-
Filesize
212KB
MD5230be104dc38d7f63793602c5e27ff8f
SHA1f304dd54c3362524b2f6a997e84160c71ae40e48
SHA2568aa166be69cdcaba12bd3d70a06af8e3717d06372dd39b9812050f304d4147de
SHA5122c141dcb2333080abe1077096d183875d7cfde6fa9d55506414e86c11c2ab5f244d9fa4c48dcea8e59586d680f460d19019d3db6e8e6c3efb9109134a9fc72ce
-
Filesize
584KB
-
Filesize
584KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
584KB
-
Filesize
92KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
2.0MB
-
Filesize
2.0MB