Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1754s
  • max time network
    1166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 09:51

General

  • Target

    GoDm/.git/index

  • Size

    2KB

  • MD5

    88b467e780f0ab582ab8628f88c30c89

  • SHA1

    0739e8ca23e20828ca8cae0dbbdf13a9169a2f71

  • SHA256

    cdcfcc11f98cceea1a6e64dc7abdf7c323222aed1a2b970fd79a35ec76ec7cb8

  • SHA512

    12814d7be19a4aa56fcc21b55ed95cdc3935b71d48227c3446c4bcd5244e18af7a64fbb4ee6e898a76f2af377d608a1d76554645e6e2a103591903769b9f1453

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\GoDm\.git\index
    1⤵
      PID:1068
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:628
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1308

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

        Filesize

        16KB

        MD5

        a563eecc4955bdd98f2ed17f03089186

        SHA1

        9dc147a9371cf38c41e9dce347c9ddb6f5f53db1

        SHA256

        e9957605a0ec13b5c56bde2cd56c91b8df081dc66213c9c526e8153a2e4ead1c

        SHA512

        0c38e249fcbf2cf547bba7aac2b7ea4029f8d5a1c595997ad48b749932488b528bc6543178f4b9806ab7fb3fb44cc57b28dd60be2df4c3112f2a936a000e688f

      • memory/1308-40-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-42-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-33-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-34-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-35-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-36-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-37-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-38-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-39-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-43-0x0000020363570000-0x0000020363571000-memory.dmp

        Filesize

        4KB

      • memory/1308-32-0x0000020363920000-0x0000020363921000-memory.dmp

        Filesize

        4KB

      • memory/1308-41-0x0000020363950000-0x0000020363951000-memory.dmp

        Filesize

        4KB

      • memory/1308-0-0x000002035B240000-0x000002035B250000-memory.dmp

        Filesize

        64KB

      • memory/1308-44-0x0000020363560000-0x0000020363561000-memory.dmp

        Filesize

        4KB

      • memory/1308-46-0x0000020363570000-0x0000020363571000-memory.dmp

        Filesize

        4KB

      • memory/1308-49-0x0000020363560000-0x0000020363561000-memory.dmp

        Filesize

        4KB

      • memory/1308-52-0x00000203634A0000-0x00000203634A1000-memory.dmp

        Filesize

        4KB

      • memory/1308-16-0x000002035B340000-0x000002035B350000-memory.dmp

        Filesize

        64KB

      • memory/1308-64-0x00000203636A0000-0x00000203636A1000-memory.dmp

        Filesize

        4KB

      • memory/1308-66-0x00000203636B0000-0x00000203636B1000-memory.dmp

        Filesize

        4KB

      • memory/1308-67-0x00000203636B0000-0x00000203636B1000-memory.dmp

        Filesize

        4KB

      • memory/1308-68-0x00000203637C0000-0x00000203637C1000-memory.dmp

        Filesize

        4KB