Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/03/2024, 00:55
General
-
Target
c5227b37fb633730ff54db4da6178cca87ec5b84b2446ada8384fbe4a344c5eb.exe
-
Size
135KB
-
MD5
80fa50927d648aaf6e91d76720af56cc
-
SHA1
8c26e72ea27529e3407045e3163b39ba1a777279
-
SHA256
c5227b37fb633730ff54db4da6178cca87ec5b84b2446ada8384fbe4a344c5eb
-
SHA512
45427fb5de220ff97bb250fa02c4fdf04c70109ce5a3be6d0647b0577466b47391a2fce0e4b633fb80a736f747b3cb3d78207a82fc12fcfbdf93c65049409ac6
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVVKR:UVqoCl/YgjxEufVU0TbTyDDalLKR
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5227b37fb633730ff54db4da6178cca87ec5b84b2446ada8384fbe4a344c5eb.exe"C:\Users\Admin\AppData\Local\Temp\c5227b37fb633730ff54db4da6178cca87ec5b84b2446ada8384fbe4a344c5eb.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5b977c5be7205715432ae0259150b1d8c
SHA134fc5da535a8a1a6e5dc6c819a9825833c50fab8
SHA256b527192f4b529410d9598d5bfb882df595d4db5ef20d876e302c39a017b59f67
SHA512dbfa7c6f44f0b2b0a79743e478efd07bb9c9552b23b01785dc8c93bbe24b46b9e278b8f4f629891264cab9747d91635e7b6c2d2d3aba7d268155f3746d7c9c35
-
Filesize
135KB
MD5deefc69f3092dc4277e9891b0c68405c
SHA1b98c57e525b140487ae02dadadd0661d8b02636c
SHA2568c3a61aa3ad9d5f28ae6df0036584ee30e06ec272d1115ee7e1ad809b2b84c61
SHA512058f18d0c1d2e2dbd940872ce719f893041e76e0710df1369a6dd662f2723d11fd620c1ffaa3c0c064677fd61370e0f8417d2f64443ce5f74b3993cb2e8c4ce8
-
Filesize
135KB
MD5678015a3cfa8880585eedf47426a3324
SHA179857bbbd14de01e94c851c05c30d3bbd2f7efa6
SHA2563e4829265af42e0c41eb6f6e6be36a72dacf48df43347e92f44350c3ca105d65
SHA512551be0fa41b77bd54888f996629f1beba97677f17fda66ff580cc3d6219619a3554bcfe6b9b0f024af72965122ff137a461e3eb745da8a388b0aa27163ee4c55
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB