Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
02/05/2024, 21:45
General
-
Target
4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9.exe
-
Size
212KB
-
MD5
5e556d0847905125d4c474d153c5ee37
-
SHA1
272b80004a631d63854404ef47e57f9fbd307e70
-
SHA256
4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9
-
SHA512
f2a2aca022ecf559566464ca0c20257a99f0ea5f56dd84b7ce610cae436ea4d9af1fc451753d4aa876d260b7b0ab131dbf03c2cab1c3885f5f3da5d8b44b6da5
-
SSDEEP
6144:zxNqLW6opBZMU/y/JEGjg+op2BSNCCr7/jU:tA6NBT/yEGjWwa7vU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 18 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9.exe"C:\Users\Admin\AppData\Local\Temp\4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
167B
MD50104c301c5e02bd6148b8703d19b3a73
SHA17436e0b4b1f8c222c38069890b75fa2baf9ca620
SHA256446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
SHA51284427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf
-
Filesize
212KB
MD518047627383252c1d9ea697f29c0894e
SHA10b5ec4a96d0a54eebc23110944df6064473a3f44
SHA2561b39a0d09edbcebac7c9ede44002e91a63a6c6983ed80326cc76711d43f1ec94
SHA512b7dc46db0e68d8078045980f70c623ac7929223a69dab7100311a9e87d6559a345ffa6847b857bfc2c0c6dc7832839629ed04ad0060742d440cff563034732d6
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
616KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
680KB
-
Filesize
616KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB