Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
206s -
max time network
240s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 13:38
General
-
Target
b30b76585ea225bdf8b4c6eedf4e6e99aff0cf8aac7cdf6fb1fa58b8bde68ab3.dll
-
Size
908KB
-
MD5
7e7b253fcfe99cf48e171533182005ea
-
SHA1
c6e306fc7b2de1e8b1d904f636113f04fef8d35c
-
SHA256
b30b76585ea225bdf8b4c6eedf4e6e99aff0cf8aac7cdf6fb1fa58b8bde68ab3
-
SHA512
b61dbc28c627db00d651b8957b4ffecdefa4c92151e27a5bc18f497063dbd6fbfd0f8b645e5e6f905cb533626d8e0f7c536cd08ee0038aa607956fa2e75730dd
-
SSDEEP
12288:I+YE32Q8n9FgCBT4jh0rOcazvLbzTq4TYSyPKcaTuxfa:IvEwnfg04jgaXbzG4TYS8KcR
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
-
Suspicious use of FindShellTrayWindow 19 IoCs
-
Suspicious use of SendNotifyMessage 12 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b30b76585ea225bdf8b4c6eedf4e6e99aff0cf8aac7cdf6fb1fa58b8bde68ab3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\8c629236519742d09867c2afca85b2bc /t 1800 /p 45881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD568ddd688cd9eece9ee6927fa020138a9
SHA1fb568dc8bb86f6abefbb105851a048cfc34e793b
SHA256644dc1ac01fb87d1a1c20dc051a3faca9c0a795d139710147b030c89ce3567be
SHA512a2b859e66b581afbbcfb4d54b10100b5b9935b35160eaedb554f415b25ad2a826a24a69b6612c01888045425f5a9b0d488eaf17d4a954e700bb002ce2b357ad4
-
Filesize
904KB
-
Filesize
32KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB