Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1502s
  • max time network
    1551s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 09:51

General

  • Target

    GoDm/errors.txt

  • Size

    2B

  • MD5

    81051bcc2cf1bedf378224b0a93e2877

  • SHA1

    ba8ab5a0280b953aa97435ff8946cbcbb2755a27

  • SHA256

    7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

  • SHA512

    1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\GoDm\errors.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2880
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:464
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4092

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4092-0-0x00000291B0D40000-0x00000291B0D50000-memory.dmp

      Filesize

      64KB

    • memory/4092-16-0x00000291B0E40000-0x00000291B0E50000-memory.dmp

      Filesize

      64KB

    • memory/4092-32-0x00000291B9150000-0x00000291B9151000-memory.dmp

      Filesize

      4KB

    • memory/4092-34-0x00000291B9180000-0x00000291B9181000-memory.dmp

      Filesize

      4KB

    • memory/4092-35-0x00000291B9180000-0x00000291B9181000-memory.dmp

      Filesize

      4KB

    • memory/4092-36-0x00000291B9290000-0x00000291B9291000-memory.dmp

      Filesize

      4KB