Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 11:44

General

  • Target

    43797e7896aba0cdb8adc48e5f9af6fd.exe

  • Size

    46KB

  • MD5

    43797e7896aba0cdb8adc48e5f9af6fd

  • SHA1

    a1033d0b68d0eba3ae0518b81bf44f66c967c4d8

  • SHA256

    5d127a38e613f07bfc80240d1a0e1ad9c1befd974ec50abae7302f4f66ab13bd

  • SHA512

    2cab895deb4733f305e23be426a672e0842b0939148f5ef43c51126ae553321fb4d96093368a9e44dcd6ab0720ae4c0937c5bd82a3a1771bc3b5ef3f242b8966

  • SSDEEP

    768:Qjq8bA/wdTnVPJzccqsE123EwLxg6gqVPqZ9K/CTE4S4QOFmIfDbzcPU:QWb/wVnhecqsv02g6gqVPqw/JCbc

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
    • C:\Users\Admin\AppData\Local\Temp\43797e7896aba0cdb8adc48e5f9af6fd.exe
      "C:\Users\Admin\AppData\Local\Temp\43797e7896aba0cdb8adc48e5f9af6fd.exe"
      1⤵
      • Modifies WinLogon for persistence
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2116

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/624-10-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB

    • memory/624-14-0x00000000170F0000-0x0000000017115000-memory.dmp

      Filesize

      148KB

    • memory/624-18-0x0000000017120000-0x0000000017145000-memory.dmp

      Filesize

      148KB

    • memory/624-22-0x0000000017150000-0x0000000017175000-memory.dmp

      Filesize

      148KB

    • memory/624-26-0x0000000017180000-0x00000000171A5000-memory.dmp

      Filesize

      148KB

    • memory/624-30-0x00000000171B0000-0x00000000171D5000-memory.dmp

      Filesize

      148KB

    • memory/624-34-0x00000000171E0000-0x0000000017205000-memory.dmp

      Filesize

      148KB

    • memory/624-38-0x0000000017210000-0x0000000017235000-memory.dmp

      Filesize

      148KB

    • memory/624-42-0x0000000017240000-0x0000000017265000-memory.dmp

      Filesize

      148KB

    • memory/624-46-0x0000000017270000-0x0000000017295000-memory.dmp

      Filesize

      148KB

    • memory/624-50-0x00000000172A0000-0x00000000172C5000-memory.dmp

      Filesize

      148KB

    • memory/624-54-0x00000000172D0000-0x00000000172F5000-memory.dmp

      Filesize

      148KB

    • memory/624-58-0x0000000017300000-0x0000000017325000-memory.dmp

      Filesize

      148KB

    • memory/624-62-0x0000000017330000-0x0000000017355000-memory.dmp

      Filesize

      148KB

    • memory/624-66-0x0000000017360000-0x0000000017385000-memory.dmp

      Filesize

      148KB

    • memory/624-70-0x0000000017390000-0x00000000173B5000-memory.dmp

      Filesize

      148KB

    • memory/624-74-0x00000000173C0000-0x00000000173E5000-memory.dmp

      Filesize

      148KB

    • memory/624-82-0x0000000017420000-0x0000000017445000-memory.dmp

      Filesize

      148KB

    • memory/624-78-0x00000000173F0000-0x0000000017415000-memory.dmp

      Filesize

      148KB

    • memory/624-86-0x0000000017450000-0x0000000017475000-memory.dmp

      Filesize

      148KB

    • memory/624-90-0x0000000017480000-0x00000000174A5000-memory.dmp

      Filesize

      148KB

    • memory/624-94-0x00000000174B0000-0x00000000174D5000-memory.dmp

      Filesize

      148KB

    • memory/624-102-0x0000000017510000-0x0000000017535000-memory.dmp

      Filesize

      148KB

    • memory/624-98-0x00000000174E0000-0x0000000017505000-memory.dmp

      Filesize

      148KB

    • memory/624-110-0x0000000017570000-0x0000000017595000-memory.dmp

      Filesize

      148KB

    • memory/624-106-0x0000000017540000-0x0000000017565000-memory.dmp

      Filesize

      148KB

    • memory/624-114-0x00000000175A0000-0x00000000175C5000-memory.dmp

      Filesize

      148KB

    • memory/624-118-0x00000000175D0000-0x00000000175F5000-memory.dmp

      Filesize

      148KB

    • memory/624-126-0x0000000017630000-0x0000000017655000-memory.dmp

      Filesize

      148KB

    • memory/624-130-0x0000000017660000-0x0000000017685000-memory.dmp

      Filesize

      148KB

    • memory/624-134-0x0000000017690000-0x00000000176B5000-memory.dmp

      Filesize

      148KB

    • memory/624-138-0x00000000176C0000-0x00000000176E5000-memory.dmp

      Filesize

      148KB

    • memory/624-142-0x00000000176F0000-0x0000000017715000-memory.dmp

      Filesize

      148KB

    • memory/624-122-0x0000000017600000-0x0000000017625000-memory.dmp

      Filesize

      148KB

    • memory/624-146-0x0000000017720000-0x0000000017745000-memory.dmp

      Filesize

      148KB

    • memory/624-150-0x0000000017750000-0x0000000017775000-memory.dmp

      Filesize

      148KB

    • memory/624-154-0x0000000017780000-0x00000000177A5000-memory.dmp

      Filesize

      148KB

    • memory/624-158-0x00000000177B0000-0x00000000177D5000-memory.dmp

      Filesize

      148KB

    • memory/624-162-0x00000000177E0000-0x0000000017805000-memory.dmp

      Filesize

      148KB

    • memory/624-166-0x0000000017810000-0x0000000017835000-memory.dmp

      Filesize

      148KB

    • memory/624-170-0x0000000017840000-0x0000000017865000-memory.dmp

      Filesize

      148KB

    • memory/624-174-0x0000000017870000-0x0000000017895000-memory.dmp

      Filesize

      148KB

    • memory/624-178-0x00000000178A0000-0x00000000178C5000-memory.dmp

      Filesize

      148KB

    • memory/624-186-0x0000000017900000-0x0000000017925000-memory.dmp

      Filesize

      148KB

    • memory/624-182-0x00000000178D0000-0x00000000178F5000-memory.dmp

      Filesize

      148KB

    • memory/624-190-0x0000000017930000-0x0000000017955000-memory.dmp

      Filesize

      148KB

    • memory/624-194-0x0000000017960000-0x0000000017985000-memory.dmp

      Filesize

      148KB

    • memory/624-198-0x0000000017990000-0x00000000179B5000-memory.dmp

      Filesize

      148KB

    • memory/624-202-0x00000000179C0000-0x00000000179E5000-memory.dmp

      Filesize

      148KB

    • memory/624-210-0x0000000017A20000-0x0000000017A45000-memory.dmp

      Filesize

      148KB

    • memory/624-214-0x0000000017A50000-0x0000000017A75000-memory.dmp

      Filesize

      148KB

    • memory/624-218-0x0000000017A80000-0x0000000017AA5000-memory.dmp

      Filesize

      148KB

    • memory/624-226-0x0000000017AE0000-0x0000000017B05000-memory.dmp

      Filesize

      148KB

    • memory/624-222-0x0000000017AB0000-0x0000000017AD5000-memory.dmp

      Filesize

      148KB

    • memory/624-234-0x0000000017B40000-0x0000000017B65000-memory.dmp

      Filesize

      148KB

    • memory/624-230-0x0000000017B10000-0x0000000017B35000-memory.dmp

      Filesize

      148KB

    • memory/624-206-0x00000000179F0000-0x0000000017A15000-memory.dmp

      Filesize

      148KB

    • memory/624-238-0x0000000017B70000-0x0000000017B95000-memory.dmp

      Filesize

      148KB

    • memory/624-242-0x0000000017BA0000-0x0000000017BC5000-memory.dmp

      Filesize

      148KB

    • memory/624-250-0x0000000017C00000-0x0000000017C25000-memory.dmp

      Filesize

      148KB

    • memory/624-246-0x0000000017BD0000-0x0000000017BF5000-memory.dmp

      Filesize

      148KB

    • memory/624-254-0x0000000017C30000-0x0000000017C55000-memory.dmp

      Filesize

      148KB

    • memory/624-258-0x0000000017C60000-0x0000000017C85000-memory.dmp

      Filesize

      148KB

    • memory/2116-0-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB

    • memory/2116-1-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB

    • memory/2116-2-0x0000000000400000-0x0000000000425000-memory.dmp

      Filesize

      148KB