Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 20:36

General

  • Target

    Pali/loader_prod.exe

  • Size

    25.8MB

  • MD5

    bf8c871604eb4297a39c675b655a9f05

  • SHA1

    f47bb195479b8f0555e21447503feb2be542ee3a

  • SHA256

    3402266e9dea3f417c15c10154ca37761740b41c1c43823b705a177cee32721e

  • SHA512

    d316caa28a270e97674069acb93a80e3d616aa5b3f284ca474234188b60238fa1dd39bc542fe6aa0f5f25d70eecca8c9ed4f3414b0bf8af217dbd7e344d0587e

  • SSDEEP

    393216:njI1es00EYUK2uKa5b/kiJQQTCKJLigXB+605007GedW6+ADmFRL3am8cRr9IrCK:njIR0062OQTjJ+JOTeiASFycRx

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pali\loader_prod.exe
    "C:\Users\Admin\AppData\Local\Temp\Pali\loader_prod.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4492-0-0x00007FFEE27B0000-0x00007FFEE27B2000-memory.dmp

    Filesize

    8KB

  • memory/4492-1-0x00007FFEE27C0000-0x00007FFEE27C2000-memory.dmp

    Filesize

    8KB

  • memory/4492-2-0x0000000140000000-0x0000000142DD2000-memory.dmp

    Filesize

    45.8MB

  • memory/4492-3-0x0000000140000000-0x0000000142DD2000-memory.dmp

    Filesize

    45.8MB

  • memory/4492-14-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-15-0x00007FFEE0B20000-0x00007FFEE0BDE000-memory.dmp

    Filesize

    760KB

  • memory/4492-16-0x00007FFEE0E10000-0x00007FFEE0FB1000-memory.dmp

    Filesize

    1.6MB

  • memory/4492-17-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-20-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-23-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-29-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-32-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-35-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-38-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-41-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-44-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-50-0x0000000140000000-0x0000000142DD2000-memory.dmp

    Filesize

    45.8MB

  • memory/4492-51-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-54-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-57-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-60-0x0000000140000000-0x0000000142DD2000-memory.dmp

    Filesize

    45.8MB

  • memory/4492-61-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-64-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-70-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-73-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-76-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-79-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-82-0x00007FFEE25B0000-0x00007FFEE27A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-114-0x0000000140000000-0x0000000142DD2000-memory.dmp

    Filesize

    45.8MB