Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

95cf89ceea...a2.rar

windows7-x64

3

95cf89ceea...a2.rar

windows10-2004-x64

7

Warm Snow ...er.exe

windows7-x64

1

Warm Snow ...er.exe

windows10-2004-x64

1

游侠网�...��.url

windows7-x64

1

游侠网�...��.url

windows10-2004-x64

1

游侠网�...��.url

windows7-x64

1

游侠网�...��.url

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Warm Snow v1.0-v20231205 Plus 15 Trainer.exe

  • Size

    1.9MB

  • MD5

    0c0a619fe74916c19c8db8cb94b63c35

  • SHA1

    eee29377b3baeb61ab963d34d166f69d04ace3ec

  • SHA256

    da18f76629df98da6c859fdda178f411ff3f05b326416a0994ae676cfd658e41

  • SHA512

    4a119c63118f01f77d411147b675ff9c4d367a485ee5c8d6d72c963c2f60a9c16041722d08c21ca87e90271cb8ae8ac869b1c11c23637ce60bd1b7cce1c15e50

  • SSDEEP

    49152:TmJeoncYOmlmJRGPlJeAp/nyxXT5XtzQx4I1:QmJMPl4D59z9I1

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Warm Snow v1.0-v20231205 Plus 15 Trainer.exe
    "C:\Users\Admin\AppData\Local\Temp\Warm Snow v1.0-v20231205 Plus 15 Trainer.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3828-0-0x0000021AA50D0000-0x0000021AA5104000-memory.dmp

    Filesize

    208KB

    Download

  • memory/3828-1-0x00007FFB42E10000-0x00007FFB438D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3828-2-0x0000021AA50A0000-0x0000021AA50B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3828-3-0x0000021AA50A0000-0x0000021AA50B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3828-4-0x0000021AA50A0000-0x0000021AA50B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3828-5-0x0000021ABF390000-0x0000021ABF398000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3828-6-0x0000021ABF410000-0x0000021ABF448000-memory.dmp

    Filesize

    224KB

    Download

  • memory/3828-7-0x0000021ABF3E0000-0x0000021ABF3EE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3828-22-0x00007FFB42E10000-0x00007FFB438D1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3828-23-0x0000021AA50A0000-0x0000021AA50B0000-memory.dmp

    Filesize

    64KB

    Download