Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/01/2024, 21:32
General
-
Target
1236c0ef970171094fba3b7895a4d3d9.exe
-
Size
37KB
-
MD5
1236c0ef970171094fba3b7895a4d3d9
-
SHA1
bca356e243b57232faabd82aaf1b94e9e620ce82
-
SHA256
c9aa5dc253264f3c11f4c87187ed9003bb83fb9382693aef3fdce55ac6f99cc6
-
SHA512
d4c56182e4206972bcd084f3e89bdc55c9f8267be7573840d64cb3301c044a8dfced474d024af78487ef0e30eb3837f02a059d409142481399d90cc8a77349fd
-
SSDEEP
384:QuSvEiTbTvpWNcZ0y8fvCv3v3cLkacJE0rAF+rMRTyN/0L+EcoinblneHQM3epzx:VS7TZ38fvCv3E1cprM+rMRa8NuUpit
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1236c0ef970171094fba3b7895a4d3d9.exe"C:\Users\Admin\AppData\Local\Temp\1236c0ef970171094fba3b7895a4d3d9.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1236c0ef970171094fba3b7895a4d3d9.exe" "1236c0ef970171094fba3b7895a4d3d9.exe" ENABLE2⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD51236c0ef970171094fba3b7895a4d3d9
SHA1bca356e243b57232faabd82aaf1b94e9e620ce82
SHA256c9aa5dc253264f3c11f4c87187ed9003bb83fb9382693aef3fdce55ac6f99cc6
SHA512d4c56182e4206972bcd084f3e89bdc55c9f8267be7573840d64cb3301c044a8dfced474d024af78487ef0e30eb3837f02a059d409142481399d90cc8a77349fd
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB