Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24/02/2024, 14:55
General
-
Target
a22111d7a13e6ef596fbc47115b88996.exe
-
Size
522KB
-
MD5
a22111d7a13e6ef596fbc47115b88996
-
SHA1
e59d05d255bb4f46a11f6d76caea908c805290bb
-
SHA256
167a40709eeea443acdc1dde01242c3dd1ff186f6b26f9f2227a6d9c20104c74
-
SHA512
405d00c9da3954d687c1ef14287b705454191cd3708020b0e64d157b20e6bf68a5d44355f13bb08d4d5ef3cb077b388611423b504b2190910eef4d9fc3aed080
-
SSDEEP
12288:mzvXykTMkkvrPI/LxH+H9tf2PaZpxSjZqe/6vnUJYv0:KvrBkTmLxHaLf2PUpxSFqKOXv
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22111d7a13e6ef596fbc47115b88996.exe"C:\Users\Admin\AppData\Local\Temp\a22111d7a13e6ef596fbc47115b88996.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\oM06504LmKnG06504\oM06504LmKnG06504.exe"C:\ProgramData\oM06504LmKnG06504\oM06504LmKnG06504.exe" "C:\Users\Admin\AppData\Local\Temp\a22111d7a13e6ef596fbc47115b88996.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
522KB
MD5ae56554f6b7aca1c5a5967cfff402266
SHA1a74662f15d0e1c3d7cac40d6f78fb3dae1162a81
SHA256b229aeb6ef81aa1d12aa6810fc133a208610d91fa5b7e4c9b2d1f91fceb2f904
SHA5124255841d40d00549219aafa303ac6e8ad1d63d67b162ba82f39486bde57623228746672fd0c644afe62081d0957611ee031c6a14e93d532e5500d64a5e5e6a79
-
Filesize
155KB
MD5f5810b028034e1c7befd83c0f5e82b66
SHA1360af1686b4a516c655accdfa3f208a585b1eea0
SHA25624e123cbd80055e67c37b0beb15d4b5635b5444667439600430b8191c2b6287a
SHA5128f3813feb5f1ca077a63f59b52d809b18f529c3819d6606d58852602e6d1fe5de703d24e81261b0393e4fc24062b379902533a20630c5aae7c4e6c485f0dfbd3
-
Filesize
1024KB
-
Filesize
868KB
-
Filesize
1024KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
1024KB
-
Filesize
868KB