Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 21:02

General

  • Target

    1b1a0de434b229a05b536a4d9aedd0a0fb62c4637982a29d8ee50f041e9c94eb.exe

  • Size

    1.6MB

  • MD5

    3472608fd3b5c0bce99d0699e35c329a

  • SHA1

    8e7c4053ebe0c0db93ce507e4517ff9a17f871be

  • SHA256

    1b1a0de434b229a05b536a4d9aedd0a0fb62c4637982a29d8ee50f041e9c94eb

  • SHA512

    0426610b25e025921486cd385655bda4cf1cf985c550ba2826d0444affde1353ac2a853870a93a609b9c34151560c81ae5ff69dac3285c56e3141d039ece9c80

  • SSDEEP

    24576:WW05k8hb0HTw+x0i2XJkrQYMkdPE1Ew2OikUX:WWok8SHTwm0Yrtd8+w2OJUX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b1a0de434b229a05b536a4d9aedd0a0fb62c4637982a29d8ee50f041e9c94eb.exe
    "C:\Users\Admin\AppData\Local\Temp\1b1a0de434b229a05b536a4d9aedd0a0fb62c4637982a29d8ee50f041e9c94eb.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1160
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System32\alg.exe

    Filesize

    1.3MB

    MD5

    5da9f6f7b8c8485c8cda2ab40c471296

    SHA1

    cf6d1fa8bb0a5abb1a488e0ffa626e9558a41e5c

    SHA256

    633a868e2bb756f8823008c130f96bcf16d51c58e2612d98d6698b9d3f68c34e

    SHA512

    37a431c55ac16b478cb6ea0fb65938c72de62e6034ca46e3661e5db92fe7d270c0c557e75ac7314c64ab736f7630ac7efe290f8ee592950e8dbc96af536b3ad4

  • memory/1160-6-0x00000000020D0000-0x0000000002130000-memory.dmp

    Filesize

    384KB

  • memory/1160-0-0x00000000020D0000-0x0000000002130000-memory.dmp

    Filesize

    384KB

  • memory/1160-10-0x0000000140000000-0x0000000140235000-memory.dmp

    Filesize

    2.2MB

  • memory/1160-13-0x0000000140000000-0x0000000140235000-memory.dmp

    Filesize

    2.2MB

  • memory/1160-11-0x00000000020D0000-0x0000000002130000-memory.dmp

    Filesize

    384KB

  • memory/4428-15-0x0000000140000000-0x00000001401E9000-memory.dmp

    Filesize

    1.9MB

  • memory/4428-16-0x0000000140000000-0x00000001401E9000-memory.dmp

    Filesize

    1.9MB