Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 11:34
General
-
Target
970e8303df550a33cc671bae08e7e47a.exe
-
Size
613KB
-
MD5
970e8303df550a33cc671bae08e7e47a
-
SHA1
11d6173967c21abc8369cc81870c00811330e413
-
SHA256
05a74d290e92fe5b9e4c1171e30aa83c3be1d0e511e42198679789b707bdae60
-
SHA512
7223122bd4ce0f641aad84bd99bb1836090ab6db99f01d14c25b7c0b9f664781f891b50ce4f9141bad90c4497bf950bbe1071e3513d5f445624040a88b241865
-
SSDEEP
12288:kwMDD4nOsuoOYjduaxfrqk1XfB0cPTRs2dVr9ZFDT6k2LyC3KxBNAC4pmZ:ktgOsu7cuaxfPi4dV7FJ+8NACom
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\970e8303df550a33cc671bae08e7e47a.exe"C:\Users\Admin\AppData\Local\Temp\970e8303df550a33cc671bae08e7e47a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DM_9tR8iG5d9h\DownloadManager.exeDownloadManager.exe "C:\Users\Admin\AppData\Local\Temp\970e8303df550a33cc671bae08e7e47a.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110B
MD5d90f30ec817672c86555083560b698f8
SHA17be9597d5b0bcef19a8de562b6d89974af3387a9
SHA2560d051d3808ee63ff5f42e4e2e78834171a244336fd5b5aaf5ba56c34c7d30f9d
SHA512afa369b0676a08c9a849d630f23b3884162549e80a3fcf3240acfaaa8b08c0cad4883bc4bb8cbd434a74a4980cf3f9f8e657276254becf095a8576d0aee76a5c
-
Filesize
1.1MB
MD5cdfe78adf74d242a4348145ea9e33f0a
SHA115e57d5ec85c53daefc08318dcbb18a904221cd9
SHA25674ad7935ce68fb5d792dafacd0cc8c5bccaf9ed8d868ced7b1a648fcca46616c
SHA5120c084ed7e779aaf5191eaf337ab181c478585fe2856d8b11e8eebbe6638e61f6dd2aaa2cdcd58beda6032071ca8e20bc1dfbda2a06cd8fc4be0e089d84f47e91
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
-
Filesize
20KB
MD5c498ae64b4971132bba676873978de1e
SHA192e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA2565552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
SHA5128e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
-
Filesize
16KB
MD5a555472395178ac8c733d90928e05017
SHA1f44b192d66473f01a6540aaec4b6c9ac4c611d35
SHA25682ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e
SHA512e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB