Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
26/04/2024, 06:47
240426-hkqc9aba9v 626/04/2024, 06:47
240426-hkprqabb44 626/04/2024, 06:47
240426-hkn57abb42 626/04/2024, 06:47
240426-hkmx5aba9t 626/04/2024, 06:47
240426-hkmmcsba81 625/04/2024, 13:14
240425-qgyt8aba6y 7Analysis
-
max time kernel
259s -
max time network
274s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
25/04/2024, 13:14
General
-
Target
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe
-
Size
131KB
-
MD5
fa158ba3d7801e203da61c7eafa12a13
-
SHA1
eb71f862c7603797a9d7d46bda545f7d9280f451
-
SHA256
ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521
-
SHA512
0f47c06526cb8d0e8302e440baac91e49e1fa3541e8d86e724c46dcc3b4ba2ffae445b3d217d58cb8ff66380036b98e82fc7b6f3980120d4c599d5497ce5edd1
-
SSDEEP
1536:BL+O/U7OBmKGS6CBK0t/ZCXPGuxgDM5YKBGNc/xf6KWcs8+SUkIcekqY1o/uImz2:BLxUyjp3xCTyDMsUWyw+Ubx7NX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe"C:\Users\Admin\AppData\Local\Temp\ef40057c0a5784ed71b745826c84c2a4d52bf9f50cc6ca4b723716a0be4ce521.exe"1⤵
- Adds Run key to start application
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB