Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24/02/2024, 10:01
General
-
Target
a1970a1fea5299a8d62cded29d0887f9.exe
-
Size
1.2MB
-
MD5
a1970a1fea5299a8d62cded29d0887f9
-
SHA1
e30c7f15fa92a866d933e494eaded5c6693f3f1d
-
SHA256
133a91688efa11374fc8df676856a5c4c02e03d5ad77edf5dd2b39d058a81ba4
-
SHA512
a8b8418bac0a0749ba7a3baffaa08638491a042449dce99cda9a609dc728662b8738d760ffbe0ec06754147f200f812558325efd9cf0c033137e7733a53986af
-
SSDEEP
24576:PmefiVzV60LqEWmddVp//cccnfHUDHr9+H8aYs/BkwjJAlt:PmPoLm//zcfKL9+HbHjjA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1970a1fea5299a8d62cded29d0887f9.exe"C:\Users\Admin\AppData\Local\Temp\a1970a1fea5299a8d62cded29d0887f9.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe"C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Users\Admin\AppData\Local\Temp\a1970a1fea5299a8d62cded29d0887f9.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x518 0x4181⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD56b90820e54da54d0e2693173f637b39d
SHA121eeaaecaec4219058b05f8642e4d5989a0ec768
SHA256fe80ba64f27e7fd22e624c865956a88227f11564ae3caebef2d63ce66bc60be0
SHA51297d8566dfd518c916a6a2af5964240cc77181d7fa0a5f8456252f1cf5562a0186d01d8a0c5090ba3378c840289a3fe46b6cedb931f89dd7b24ccbabd3eaf0d33
-
Filesize
957KB
MD556423d7f3ce83c7ff33f5c65f31aee8d
SHA1fbde9aa7ef24de55db0c2c3b44bf765e30e7498a
SHA256df35b8b3746db8eed32cf57cff38912835322cabfda85941252a8d7b82475abe
SHA512ea4fb1b4801346639faa779134c0d528d64c69883c9e81998e4901e3485cc459546ec38103b544c9432bc221457f6442d89dd11c97e6cb9a60eccef2234fadad
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB