Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1801s -
max time network
1696s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-es -
resource tags
arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
23/04/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
Toolbox OptimizerV1.0.exe
Resource
win7-20240221-es
Behavioral task
behavioral2
Sample
Toolbox OptimizerV1.0.exe
Resource
win10v2004-20240226-es
General
-
Target
Toolbox OptimizerV1.0.exe
-
Size
455KB
-
MD5
0569b38220c2d30697ffbc398308f213
-
SHA1
d01b93f9b2c6c6f8269e47134ee2a8639cdb29af
-
SHA256
cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e
-
SHA512
380ad86a1f83d2f9cd2461f666fc38245c8a0dea1a6bcdf5ad5b161fd72d092826cb5fb33bb278cec09866e9a8dfa95b054fa1d35719e52665e85cfbdfe9374f
-
SSDEEP
3072:Q7DhdC6kzWypvaQ0FxyNTBf87pzseuW8Rz7m2klts+CDiVsgw7b6:QBlkZvaF4NTBE7LUKwzgw7b6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1536 msedge.exe 1536 msedge.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3932 wrote to memory of 3324 3932 Toolbox OptimizerV1.0.exe 96 PID 3932 wrote to memory of 3324 3932 Toolbox OptimizerV1.0.exe 96 PID 3324 wrote to memory of 1048 3324 cmd.exe 97 PID 3324 wrote to memory of 1048 3324 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BA33.tmp\BAD0.tmp\BAE1.bat "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\system32\mode.commode con:cols=128 lines=403⤵PID:1048
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6292 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:81⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6068 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:81⤵PID:932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5196 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:81⤵PID:4584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD53512b263fbfaa854e3dffc248d511dd4
SHA1db752939ffb2659bd32b9c4b91c2173a6a505082
SHA2567dc4222c41085904ae65a81d758911fd0b1ef3f0578368fc5d17c3e0240d2450
SHA5128f54d744bf9e1368352049f3ec9aa5422494c66d7ea1e9893b3d0daecc773810148076dcfe1160b2f36ee93aa5b18ff013992b6e3abd1c8517429ff76b54cba2