Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
d4abeb6c2c89a005f16b4c6a92fe82f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d4abeb6c2c89a005f16b4c6a92fe82f9.exe
Resource
win10v2004-20240226-en
General
-
Target
d4abeb6c2c89a005f16b4c6a92fe82f9.exe
-
Size
460KB
-
MD5
d4abeb6c2c89a005f16b4c6a92fe82f9
-
SHA1
1636b01cd057402a1d594eb685d04aa1a49f3e5a
-
SHA256
1463d442219e986fa41bdd13d0da2d51a629623ee75d1bb2ac103201533fa7aa
-
SHA512
b8b3dd5c8e989ed1c518c44df83f4a1a6cd748a44a558bed4372638037ff87c7d8b558f1e3aa2638c2e8a26a3f073b851ba42701ca368b1eabc6bea59023a9e0
-
SSDEEP
6144:UXP2VguYIgrGRq6t2BfkXws/ZDNmSEk/UnOJtxw051M6Jp/+hTg8cdlbv6lYP:qkgrL6qMgs/NNSksnOfx55/aG6q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4604 ondkbntwcokx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4604 ondkbntwcokx.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4604 ondkbntwcokx.exe 4604 ondkbntwcokx.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3620 wrote to memory of 4604 3620 d4abeb6c2c89a005f16b4c6a92fe82f9.exe 87 PID 3620 wrote to memory of 4604 3620 d4abeb6c2c89a005f16b4c6a92fe82f9.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4abeb6c2c89a005f16b4c6a92fe82f9.exe"C:\Users\Admin\AppData\Local\Temp\d4abeb6c2c89a005f16b4c6a92fe82f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\ifoxleoodbnfvoh\ondkbntwcokx.exe"C:\Users\Admin\AppData\Local\Temp\ifoxleoodbnfvoh\ondkbntwcokx.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4604
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD589c976f01a0ceacaa0a7cb71932fccd7
SHA106939f38267366dbfbb2576c1582fa4ededa6279
SHA256c6a4a50e1fdcd77b67f06e35ae70280b3d1ef5e83e60df30175d0a71e165f89f
SHA512f0bf8ed1945840b3cd8dbfc21e90dd9426796bf8bfae766fb00812e41045e800b80adebca7ad597605ec3ada778c3791acf297d7bafb0445c1a11895b4ce900f
-
Filesize
460KB
MD5d4abeb6c2c89a005f16b4c6a92fe82f9
SHA11636b01cd057402a1d594eb685d04aa1a49f3e5a
SHA2561463d442219e986fa41bdd13d0da2d51a629623ee75d1bb2ac103201533fa7aa
SHA512b8b3dd5c8e989ed1c518c44df83f4a1a6cd748a44a558bed4372638037ff87c7d8b558f1e3aa2638c2e8a26a3f073b851ba42701ca368b1eabc6bea59023a9e0