Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 09:29
General
-
Target
9b51a5efe3ee8ab6d2ce19e4e56d0357.exe
-
Size
211KB
-
MD5
9b51a5efe3ee8ab6d2ce19e4e56d0357
-
SHA1
35d876a14a3a8f7a15e4f39a7cbbce6b1f35078f
-
SHA256
744c68306b42089e9aa6521db82dbafca142d642b8c7eb0c9b6747bf68d0b8d3
-
SHA512
9458551ccd0c57f3de817e8132fc30f0325080a44d2c8eed9065f14419957868a3016f628629e3f81ec6978880a4b9b4399647e45c9611518fec45fcf66d3f31
-
SSDEEP
3072:0GwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:0G/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b51a5efe3ee8ab6d2ce19e4e56d0357.exe"C:\Users\Admin\AppData\Local\Temp\9b51a5efe3ee8ab6d2ce19e4e56d0357.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
2KB
MD5725409de8fcc3f613155e614e6988910
SHA1ea3447239f4f3b559464104f979794fd489f5563
SHA256a83f25eed899d1e2ad725432d9ed15826475a519522a3df8dbadf6a6aa9f50d5
SHA512d5250a92216115ca900fbbbc5c315820b491901fd040a233ac9b92cf44a5bc865f7a9bb0741d7563a7791f2af53fe71b01ea24cd322c1604ce4d367c60b89bad
-
Filesize
1KB
MD5ee859d7cfdd1c1cb443a268d62a305a1
SHA1db5c78af22eb4c167a9a1316a72c840e5a5f77bb
SHA256d47f95699d74aa4eb0a83cb792ff107e94c4a48ca036b9313056d97fce551b18
SHA512dfaa32a6d29d2a01fb0445a356c9b2546f1685907f05d71ea6d6a559277ae2073d6631a79f47fe3214979ac644a01d54a9bf64c770273ec53478101e7b2632e4
-
Filesize
481B
MD5fdb8e6faa8609a028297daac4eac1eb5
SHA13d1416df18a32bea89d30e5e08552a1eac355859
SHA256d1cbcc8d6fc54d03289bf0e84794b3a0d3ea0517d162bf1733f8ebb7c5110878
SHA512f9c7bec5ae52d2533b1af18a690214c667bda22f14d9d12dd0d68e235347c5dd33b40f4c6634ec0555e8b65c4361140fe5ddc8bd6f144ee986ffeecf872ff1d2
-
Filesize
1KB
MD553a93812117015375bddb4d444a41312
SHA181dba2476583928f70f0c83be91f1bb5149f66e8
SHA2561340b12d970b09506bd0af3b1b64d869a95380965900ad275fcb024eaa529a32
SHA512f8e9d8f98bd47c5b36709b434bd4b3acb4b033c6c35e641762e00ae344481752d94d682419704e1c5d3098a2a2cbb0b03747d50534008b4e39e6fa92226b7aa4
-
Filesize
22KB
MD53d9f0fe82f592fd9409ca76b5baee217
SHA1f5de8a79988d394b0b85b67c7dc3efcce766ceab
SHA2563318bdd1a6b29bae7de3286a7933d7704715ec0183475552b61dbe5c652692b9
SHA512f48dddcabafbb308a3b7442f9323a696876efee4270952f0e3c09549e81fa05b254dcfa3e633f8a99a452a8ae732dff74b9d88534a130c19669370464eb6866d
-
Filesize
481B
MD5c0b97e3b9610017ed7591a997cf706f7
SHA116c2254300ed09453204b6f55bc0d305038b2f89
SHA25615ddaf050fe9763416982fccbf9bba59477efc970da567d217304b7150aa4457
SHA5126d0acb71eb4ce02d49494c3ee38429a0c738f236a388d33aa94917effee0c2c74a3480f2a459dcc79c689c6e99f090419e66a771a746c1875839f9b96eea8137
-
Filesize
42KB
MD5db5d0d4fa484a4678be5dd48b8e44f39
SHA1addcd23cd2c565ec6e0f628d9c97422f09e485d1
SHA256d774cbcaa48c95ac9146b78f68347eec66eb74b3216410dc6c7fd4a01bafcf64
SHA512d2739a584045bdc0ddada27424bd884e7444461d4125bb056d40076ac3caca7521215045d72b6283511f5580e2a9a8c17aa2c383b251c7dda8e1a720fa554ec3
-
Filesize
315B
MD5b0e58b5c7f1a13dc54919f55661a957e
SHA19575c07248ff0257e88e7a053b421e067a6e9f81
SHA2568167c759b25907ab300486653a68223495399f7b4c5d62c7432e9e000df514f8
SHA5127e736a9627f84490cdb7ed1adbe3a905a74c2aedbec161cfe800ec6f3fd0ab5263583987e421a703fab1b373d1e7388e34d4d974e7b53518e874a473e061a7ca
-
Filesize
23KB
MD500b0526a190cc145ec9fe8cb31a6352f
SHA19dd217e92cb3c6e9082643d977874623784f5053
SHA256cf90622b16d325528c3b95449fc7b3c30636a52455c16e90b1e71fef39de67fc
SHA512623b48a1ca1cf3e461835aa3a726ad7ff35eb9e0954f52ba15b2301d4457d4e3e076d17333edd610a1384f1e1a7d2fbba082b708c6ff12f3ec250591783290a3
-
Filesize
2KB
MD5a8fdd0012e6998420474a0c0669327c4
SHA1aa0b687e766c259a247c16677f4c631ce542fc6e
SHA25685a0119ffb919c7b1157dabbc8e40897f97ce6544f89931e503564966057d5d6
SHA512bd834b7119f51ef0c741d2c0696e449e13a003140ad631f5e272130cac2d30f8cb25a5e76cc415ddf6208ee920efed6c7c33519b8f1bd02dd4ae8d3f39e926f5
-
Filesize
2KB
MD5c1a8667b6ac05935847f4fcf6db3237d
SHA12dbfe6b587fa663f2a30ff5bf08bd6e000ea13ef
SHA256e2fbbebe76c439a6831280f3e13858962710f3f7811ff500905a2d5c488294e4
SHA512aaa6e8b1fc514ea30846acdf7daccadca9a386318c3dd169e76c07f9bdb6e2c9ee57a3ea17169198babe9d5d5c62d7b76ac4e8b3ccb34b04185782fd656b53b1
-
Filesize
211KB
MD53f76aead857771996efdb7a163c2c88d
SHA150d6ea8881940b002f2124fa1a88be11f3139197
SHA2567f3fbab7cbe648a40577110f716a44d94181b247a66a0e4967f826fcf0ea05af
SHA5127a6d40a153bed6d269c46583fba933732f09c44a974c687b149b6bf8d73f4e86ce2370998ed4e147692511f39bffcdd8a0dd40d9e9541d5dbf7f6f5c561db0fc
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB