Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 02:14

General

  • Target

    8a9bea061091cff92cd8de5c08ca9d33.exe

  • Size

    160KB

  • MD5

    8a9bea061091cff92cd8de5c08ca9d33

  • SHA1

    8a35f3f5395427f78f00d55e1b616a99a02820b1

  • SHA256

    bef79e59be13459d6095d9be063852a858b0bdb6db30946a2dbaf55cff7e81f2

  • SHA512

    82e4d6a5c9a5d006019da9fa5514e97153e5060dde299a88c49b49bd93c25ebf4e7588dfdda5e4fd91421e2b5756414a280e1a4cf153276d2e254145eb7ac0d6

  • SSDEEP

    3072:y+f72z/3ZRcuVtdJOJ91ax/bWtwMHEA1lYAMjMNZqm4wRo5gam5x+3gT:yv7HeGx/21kbYC7mo5gee

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a9bea061091cff92cd8de5c08ca9d33.exe
    "C:\Users\Admin\AppData\Local\Temp\8a9bea061091cff92cd8de5c08ca9d33.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1668-2-0x00000000005C0000-0x00000000005C4000-memory.dmp

    Filesize

    16KB

  • memory/1668-3-0x0000000000710000-0x0000000000749000-memory.dmp

    Filesize

    228KB

  • memory/1668-4-0x00000000022F0000-0x0000000002300000-memory.dmp

    Filesize

    64KB

  • memory/1668-1-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1668-5-0x00000000772A2000-0x00000000772A3000-memory.dmp

    Filesize

    4KB

  • memory/1668-7-0x0000000002370000-0x0000000002380000-memory.dmp

    Filesize

    64KB

  • memory/1668-6-0x0000000002600000-0x0000000002610000-memory.dmp

    Filesize

    64KB

  • memory/1668-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1668-9-0x00000000772A3000-0x00000000772A4000-memory.dmp

    Filesize

    4KB

  • memory/1668-8-0x0000000076770000-0x0000000076860000-memory.dmp

    Filesize

    960KB

  • memory/1668-10-0x0000000077293000-0x0000000077294000-memory.dmp

    Filesize

    4KB

  • memory/1668-11-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1668-12-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/1668-14-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/1668-13-0x000000004C300000-0x000000004C37A000-memory.dmp

    Filesize

    488KB

  • memory/1668-15-0x000000004C300000-0x000000004C37A000-memory.dmp

    Filesize

    488KB

  • memory/1668-17-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/1668-19-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1668-20-0x0000000000710000-0x0000000000749000-memory.dmp

    Filesize

    228KB

  • memory/1668-21-0x0000000076770000-0x0000000076860000-memory.dmp

    Filesize

    960KB