Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 04:24

General

  • Target

    eb07d08b797e3dce9c36909dd1a59f93ca95817f668aeec681f553bee1ee6699.exe

  • Size

    1.7MB

  • MD5

    d6f6ed02f4d9f3606fe6118eaa63ec59

  • SHA1

    6c697d5072db366d3feed1030457c14caba8ad5d

  • SHA256

    eb07d08b797e3dce9c36909dd1a59f93ca95817f668aeec681f553bee1ee6699

  • SHA512

    7580568a70c4bb886f30c7cb23f8f006bc3f88513b8d23a403db868a59be80578bd7b99d21e9796dee2c11b241ca13c6d3e26404f03a745ff126e90490aac902

  • SSDEEP

    24576:jOw8RD48DjnVoqzhNK41If/u8LVPQdQ7jxW32ciHjatr0zAiX90z/F0jsFB3SQk2:wBU41IuQmmjxW32/HjaB0zj0yjoB2

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb07d08b797e3dce9c36909dd1a59f93ca95817f668aeec681f553bee1ee6699.exe
    "C:\Users\Admin\AppData\Local\Temp\eb07d08b797e3dce9c36909dd1a59f93ca95817f668aeec681f553bee1ee6699.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2304-0-0x0000000000400000-0x00000000005C7000-memory.dmp

    Filesize

    1.8MB

  • memory/2304-1-0x0000000000B70000-0x0000000000BD7000-memory.dmp

    Filesize

    412KB

  • memory/2304-6-0x0000000000B70000-0x0000000000BD7000-memory.dmp

    Filesize

    412KB

  • memory/2304-10-0x0000000000400000-0x00000000005C7000-memory.dmp

    Filesize

    1.8MB