Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
02/01/2024, 08:57
General
-
Target
aa75cbd3f282aca8d63933673abe2ea0597549a65e9fd49f5cd00976fc9ffafe.exe
-
Size
536KB
-
MD5
4886ee77dbc910da2e6bdb830eed4140
-
SHA1
330950e6794e78ac3d9f736c43a05317c8328b49
-
SHA256
aa75cbd3f282aca8d63933673abe2ea0597549a65e9fd49f5cd00976fc9ffafe
-
SHA512
ae28c1174046e1e7a026304e3e0f2ba77700d12485c7a5598894d02a015d61f502aadd837e087f0434ffc163409c41c563c985be2f4b247b8053ab459ec19a76
-
SSDEEP
12288:Khf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:KdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa75cbd3f282aca8d63933673abe2ea0597549a65e9fd49f5cd00976fc9ffafe.exe"C:\Users\Admin\AppData\Local\Temp\aa75cbd3f282aca8d63933673abe2ea0597549a65e9fd49f5cd00976fc9ffafe.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55a41daacc1b1f5c680954298ee0e5ddb
SHA1de3148f7137ec0c22c9044e7ce2a577d59accf69
SHA2569c0071af54e0b9335ecf5feea5b0da5b30306d3d065d5ccca71b7db389bcb82c
SHA512c6871264601e98fd1d200afd0bb5eecdee8d79bbfc5aed3457f4c1f0c050099db322b057e7aac16de7d452aba87a2d64ce809fb387ce6c5ac4b47faeb0decfa3
-
Filesize
938B
MD5596efc00ea4325ff6b4ab2347a5956ec
SHA165cd651905b293b692ef87a30b0a8235608078ce
SHA256c2e26e0caae647d3c482ee241841ce423be2e462d70abf4b75bd7436457cf9ed
SHA512de9bd24915bb11921192fb7747f124397855a46a65b5f022d41321e836beec7128e095b1abf8201d2e01682e3b594f69907085eefa558f6f04f1e46e06759b90
-
Filesize
502B
MD58bcbaf1aa6ce8d28346063aff062eb4d
SHA1fd5de95f0edf5b654b51ceebb4bee94f1938fcbb
SHA256937475a4328bd4c7cbbda26f2e0a0bca9a65a33c04ad152aa69df71ad26a114f
SHA5123f2a293b5e335868e3872b6c08d6314c5ac7d7f0a1d3737d89636d22349e957cf0b28d00a976567a50443cab1d63f485a66cbe4ef58057421db4cdd4f3fd3e7e
-
Filesize
520B
MD558cbdd49528a032f6c97b6ca0a59df3d
SHA138945d97af91269f22c7a282c1bfe44c4c65142d
SHA256dd5f8e67778afacbee2473767305b2b7ee422b27b5accf3bb954068da96cc78c
SHA51281393b2c616b5b525081c738aa1ccd7302eb2c73ead7fd7b894e872a91b1b5daed29ed501b762b11353d6c26c0bc065e0ba2c4914f978ac9efbfbe907743d589
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB