Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/04/2024, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
winrar-x64-700.exe
Resource
win11-20240412-en
General
-
Target
winrar-x64-700.exe
-
Size
3.7MB
-
MD5
fc7776eec30751e169e1089bc2a4c478
-
SHA1
99cdb78719ca97c7351aa75f1566224396d9033b
-
SHA256
426b7b38ca6de20f1f6535d2fa63c16e11780c7cd5f2ebc66ff9a0022e246e83
-
SHA512
bc94f526d4dd751a44071dd6f540f2957d96f5c6500d7e5bb41ec6581bb0a584a6bb91fe13f7a1d9c7749c4601b1fe95f2a12a204b73bdc9a37c83cff7ac35c3
-
SSDEEP
98304:DWa7BfKE1j89JaPj/WjK/8Zx1ga9sLuj0jKVPfbkIJC8ag83dckYq8o:qacqj8cWjKixSaO2VPf4/8a3dcR8
Malware Config
Signatures
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 840 winrar-x64-700.exe 840 winrar-x64-700.exe 5096 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\winrar-x64-700.exe"C:\Users\Admin\AppData\Local\Temp\winrar-x64-700.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:840
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5096
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5e8197e68deaabec1caac808d8a1b1202
SHA13b706ac97224e95f5db57eb60acf067ccf2d4c95
SHA25689d5da8ae7c25fce8f1b74b2a02f4cb9d524dac5b752b35e511d399259a26d66
SHA512609e6013c4683519b1d7448c2417ec3f528a0764f1ae9c9cedc213ceec2df497c187164e7b713e4a78236e17f6fc9680630551a7fec98c2432e308a48b8e66e0