Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2024, 09:41

General

  • Target

    8691cedae9f9b11a4b4c8c9f7cdb3171.exe

  • Size

    7.0MB

  • MD5

    8691cedae9f9b11a4b4c8c9f7cdb3171

  • SHA1

    b75c27f11680c9a2f8c65cf3a2d84a04538a394f

  • SHA256

    d2a8a300aac8a0b25fee60ac3970149caa0670d33b37b7922b41b689e7ae3504

  • SHA512

    16e0e130141201a882166aaef5173f3085e2ebe09c9bfa5213ea2f275701318d48c747e7d3df49faec487dd5455a09d3a9e1edcc76348e666ab21959f339bf84

  • SSDEEP

    196608:ctEQzd/Cvy7n1t/TOsSLpR8vwuN58Ipt:2ELOxSNyvlZ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8691cedae9f9b11a4b4c8c9f7cdb3171.exe
    "C:\Users\Admin\AppData\Local\Temp\8691cedae9f9b11a4b4c8c9f7cdb3171.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • memory/4068-100-0x000002737D2E0000-0x000002737D2E8000-memory.dmp

    Filesize

    32KB

  • memory/4068-103-0x000002737F500000-0x000002737F686000-memory.dmp

    Filesize

    1.5MB

  • memory/4068-3-0x0000027319AE0000-0x0000027319AEA000-memory.dmp

    Filesize

    40KB

  • memory/4068-58-0x000002731F120000-0x000002731F128000-memory.dmp

    Filesize

    32KB

  • memory/4068-86-0x000002731EC50000-0x000002731ED64000-memory.dmp

    Filesize

    1.1MB

  • memory/4068-89-0x000002737F310000-0x000002737F350000-memory.dmp

    Filesize

    256KB

  • memory/4068-1-0x00007FFAE3B80000-0x00007FFAE4641000-memory.dmp

    Filesize

    10.8MB

  • memory/4068-0-0x000002737C810000-0x000002737CF1A000-memory.dmp

    Filesize

    7.0MB

  • memory/4068-2-0x000002737F4F0000-0x000002737F500000-memory.dmp

    Filesize

    64KB

  • memory/4068-104-0x000002737F4F0000-0x000002737F500000-memory.dmp

    Filesize

    64KB

  • memory/4068-102-0x000002731BA40000-0x000002731BA7E000-memory.dmp

    Filesize

    248KB

  • memory/4068-105-0x000002737F4F0000-0x000002737F500000-memory.dmp

    Filesize

    64KB

  • memory/4068-106-0x000002737D2F0000-0x000002737D2F8000-memory.dmp

    Filesize

    32KB

  • memory/4068-107-0x00007FFAE3B80000-0x00007FFAE4641000-memory.dmp

    Filesize

    10.8MB

  • memory/4068-108-0x000002737F4F0000-0x000002737F500000-memory.dmp

    Filesize

    64KB

  • memory/4068-109-0x000002737F4F0000-0x000002737F500000-memory.dmp

    Filesize

    64KB

  • memory/4068-110-0x000002737F4F0000-0x000002737F500000-memory.dmp

    Filesize

    64KB