Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    57s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/02/2024, 19:34

General

  • Target

    Optimizer-16.4.exe

  • Size

    2.3MB

  • MD5

    9352623ba2fee1206079ce3d81bf0132

  • SHA1

    9c398c2d975d82ba1e46f3bcc0e6298a2b713b8d

  • SHA256

    f4775567ca9941b4fb3224d97b0741ae669eedfcb0d8b3c71106b21bdb1aee28

  • SHA512

    a38cef70819524a3ba8d7583b763da3fac71a9b67e832165f14f60568f7a2a07f67418bb7f7a544b32aa3d76a4fa9a6b142a3998cf362a116171ed4fae05187e

  • SSDEEP

    24576:QqsJmQYTZZ4GKTnbv7DO9JvvEC8ZJC3Bjk38WuBcAbwoA/BkjSHXP36RMG:QMH4VTnbv7uEC8Zw3CSA/Bkj0

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Optimizer-16.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Optimizer-16.4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Optimizer\Optimizer.log

    Filesize

    291B

    MD5

    943252780ef021f0d05f3346c20cbf6c

    SHA1

    a9a6535feeb5c373afd42c17db56abe7c0b7f449

    SHA256

    9f6b09f7bd43690300d9ca24a0a1bf1173ed160cca281bfa8531b44e7ac90945

    SHA512

    6a75ad42538360f34351856281a592768274f6468f363f4a45ddf1596b7d4c7956879a1864f8486b6b38899fb66e78e22493c2f430f1c1d609d590d87c7cfbfe

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1msfggk.gg2.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1828-37-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-73-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-24-0x00000295BA840000-0x00000295BA8B6000-memory.dmp

    Filesize

    472KB

  • memory/1828-25-0x00000295A17B0000-0x00000295A17D2000-memory.dmp

    Filesize

    136KB

  • memory/1828-27-0x00000295A16E0000-0x00000295A16FE000-memory.dmp

    Filesize

    120KB

  • memory/1828-28-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-29-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-30-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-31-0x00007FFBDDB40000-0x00007FFBDE601000-memory.dmp

    Filesize

    10.8MB

  • memory/1828-32-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-0-0x000002959F800000-0x000002959FA58000-memory.dmp

    Filesize

    2.3MB

  • memory/1828-38-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-3-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-51-0x00000295BDEE0000-0x00000295BDEF6000-memory.dmp

    Filesize

    88KB

  • memory/1828-39-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-52-0x00000295BDF00000-0x00000295BDF0A000-memory.dmp

    Filesize

    40KB

  • memory/1828-53-0x00000295BDF70000-0x00000295BDF96000-memory.dmp

    Filesize

    152KB

  • memory/1828-1-0x00000295A1630000-0x00000295A16E2000-memory.dmp

    Filesize

    712KB

  • memory/1828-69-0x00000295BE780000-0x00000295BE792000-memory.dmp

    Filesize

    72KB

  • memory/1828-70-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-72-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-2-0x00007FFBDDB40000-0x00007FFBDE601000-memory.dmp

    Filesize

    10.8MB

  • memory/1828-74-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-75-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB

  • memory/1828-76-0x00000295BA1A0000-0x00000295BA1B0000-memory.dmp

    Filesize

    64KB