Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 05:36

General

  • Target

    23ed290735d95b2b7bb791afb9c03a55873e97e2d1aad3aa2c54da08ab96b504.exe

  • Size

    7.1MB

  • MD5

    b40393d9c47c9c1d1d90bc9a2ee083a7

  • SHA1

    0831a1abaef08bc316cdb2e89caef4d2172feaed

  • SHA256

    23ed290735d95b2b7bb791afb9c03a55873e97e2d1aad3aa2c54da08ab96b504

  • SHA512

    dfbd7c3d966b2d265dbda7f8544827fac684494ded54729ef45d9097e239f13b8c02be182d3bca484e59ffc026080e19b80e0042caade5a9331ab3fa0ceb81c5

  • SSDEEP

    49152:3d6zsl6Drb/TZvO90d7HjmAFd4A64nsfJoHxuBreShwrsGHHyjSqAQcY7s+SeBfk:9I3xxHre97sc9tceZEkZa

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23ed290735d95b2b7bb791afb9c03a55873e97e2d1aad3aa2c54da08ab96b504.exe
    "C:\Users\Admin\AppData\Local\Temp\23ed290735d95b2b7bb791afb9c03a55873e97e2d1aad3aa2c54da08ab96b504.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get processorid
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4488
    • C:\Windows\System32\Wbem\wmic.exe
      wmic baseboard get serialnumber
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Config\DeviceInfo.json

    Filesize

    455B

    MD5

    cf32727092e5f9fb3a0edc152820b8d7

    SHA1

    77b6e7e1f55462cc36256be2bf9f42f41abc5788

    SHA256

    400f46283c29d043c7ddd9fd755b2de5f4ca2bac2e4d6faeb6ab38cae8256aa8

    SHA512

    74f6e67b9131ca97efbd6f00f3a99a0db3f25510a7b9e803f19c3b065e2ed1eff8f925b55fc08216aa5c3fc99b51a2662a019a81a3c558de18c2f720d9dc9e7d