Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/03/2024, 19:12

240305-xwl8asff85 6

05/03/2024, 19:09

240305-xts8tsff45 6

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 19:12

General

  • Target

    N00bs Account Generator/N00bAccountGen.exe

  • Size

    9KB

  • MD5

    f6da01bf90fa70802582829e872772ef

  • SHA1

    571cde44d8604d0e3fac00f0ad76776db695b3fb

  • SHA256

    91ce8eebd837be4cfb13fac9fb570ca03b3e449033586a392804093824f050b7

  • SHA512

    99a8fce7e587991924533e051b96eb27b179df1288717a2cd2711bcda71ff50c7730bd1a70ab6f707e4a25a03477bdce1c62e5839865c5081a32e31fdc7be319

  • SSDEEP

    96:lVvB5JtI3o32KybnE20qyAqHM9I1zm+W+H1ciaTGHpSdA1p1f3H6eGlzNt:lLObYbsWhmP+HWioSoAFfLGf

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\N00bs Account Generator\N00bAccountGen.exe
    "C:\Users\Admin\AppData\Local\Temp\N00bs Account Generator\N00bAccountGen.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/212-0-0x0000000000770000-0x0000000000778000-memory.dmp

    Filesize

    32KB

  • memory/212-1-0x00000000751F0000-0x00000000759A0000-memory.dmp

    Filesize

    7.7MB

  • memory/212-2-0x00000000056A0000-0x0000000005C44000-memory.dmp

    Filesize

    5.6MB

  • memory/212-3-0x00000000050F0000-0x0000000005118000-memory.dmp

    Filesize

    160KB

  • memory/212-4-0x0000000005580000-0x0000000005612000-memory.dmp

    Filesize

    584KB

  • memory/212-5-0x0000000005DB0000-0x0000000005DC0000-memory.dmp

    Filesize

    64KB

  • memory/212-6-0x0000000005570000-0x000000000557A000-memory.dmp

    Filesize

    40KB

  • memory/212-7-0x0000000005DB0000-0x0000000005DC0000-memory.dmp

    Filesize

    64KB

  • memory/212-8-0x00000000751F0000-0x00000000759A0000-memory.dmp

    Filesize

    7.7MB

  • memory/212-9-0x0000000005DB0000-0x0000000005DC0000-memory.dmp

    Filesize

    64KB

  • memory/212-10-0x0000000005DB0000-0x0000000005DC0000-memory.dmp

    Filesize

    64KB

  • memory/212-12-0x00000000751F0000-0x00000000759A0000-memory.dmp

    Filesize

    7.7MB