Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
18/01/2024, 20:24
General
-
Target
Celex (cracked).exe
-
Size
2.7MB
-
MD5
7b0750070fed30ea3e66de3c90abf68d
-
SHA1
0d657289adf669f3b0c9c6ef643997d56c79531a
-
SHA256
8df8f59c744cc74d93092dfa06a2b68906c0434ad20292414aedfb4c0d929d6e
-
SHA512
c8f9110a233535faec6902940f119e85486ae9c901b954f9e950b04cd960f859c434376fa52a08bd7c7a3bd82842bbdaae88527cda93ca1e8cf6a2590bc443a6
-
SSDEEP
49152:sMzZR3CQk3a8iUqvra6DsSlxLqX16wx+VqWiozcU4+zA5B41/vjlPnqVffwLRJ5B:sSZR7kKTvrrxL66faozdhzAgsRfuRJ5B
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Drops file in System32 directory 1 IoCs
-
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celex (cracked).exe"C:\Users\Admin\AppData\Local\Temp\Celex (cracked).exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RQZMZQAE"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RQZMZQAE" binpath= "C:\ProgramData\CelexCRACKED" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "RQZMZQAE"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force1⤵
-
C:\ProgramData\CelexCRACKEDC:\ProgramData\CelexCRACKED1⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD536df31900e889a4099b2d60bcc6f42c9
SHA1f7271e33da7e60da1b54408325a94fe0d40f504a
SHA256770e14f5728475c70b11f5a0c5577913085ed1c8191597126992633a1361ec7b
SHA512239d46296c9d84c65d1c05661b7b21cb2a4904a888b755ab52da9be0080c83385ecac9a61670a799db18d30c408b7da95243221ec0d96160968cd9ed153048d9
-
Filesize
181KB
MD5fb8d4da9a08ac91f94077dd9d9fb3c75
SHA16911f85b1b0319d38482733370bb78b663062dd8
SHA256ada2be8c01a49dae0756ec49da2711d26c19dad2ea2263272a28b0dd4798dbed
SHA512ca421782f14b44d7ec9578d65efc96e1f22917de7fbfe309bbcb1418b12599036b14d88613415717c6730dc0e879daa5222607463fb936b027972bf11a53611a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD57da4ddde490bb65c402bf05d11f619b5
SHA18449bfe6190a7564108ffcec52824699ab339883
SHA2566aa519846c77845366cc5e9ba0292c18e3fa271b0b3a2fbfb83c0c27c3d57f31
SHA512d967bdbaff2f7bf7fe33fd0731c3516a2e08fa67e682dd6f9b3b62ba3b25c9683cf4200060ae237fc1c04b4936f6861ca4ac83704756ac2a0c228e9e30b49774
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
716KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
64KB