Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2024, 01:07

General

  • Target

    1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe

  • Size

    4.4MB

  • MD5

    c96e728ba7febe27e85b9acc04ddbf2c

  • SHA1

    de8c3ff03cdf8a32bdb16fdaaaeff4b68fab72a0

  • SHA256

    1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308

  • SHA512

    f7606c02954b87b964cbd1aa208330fdc0af42e959d30fe64bf908647fb3efa241dd94b534ec4bd1f4a3fb07ba086702dfbbb96fc6b4d4e2032d56df27f25bc3

  • SSDEEP

    98304:AyJOZ0Fb32Sh4H8U5I49z0Uwk3kqXf0FF5v:AyEZMhmPI49d13kSIFF

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
    "C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.core.dll

    Filesize

    538KB

    MD5

    f1dac51a74f4799838be29934a288c5c

    SHA1

    1e3ef5deb4e3f7a01656fbc3b7833276c3297a2f

    SHA256

    a7baa548c354ef9223f4fd19d2bae33c3eb8cb987bf7b577828897388110740f

    SHA512

    7d2a9f31d41a5f81cadf55961bf7fcc9eaa64393427e530303bc966088978cf28b22a186cb82ba251d82d210a4bd37c753f11e058209ea0e26dd2af91e1db5ab

  • C:\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.wpf.dll

    Filesize

    46KB

    MD5

    9022d0f3e7b23ac1525b01d339582bd8

    SHA1

    97919a2bf43a7f3ada9fecb1fc9e6d5cc673f46c

    SHA256

    ba0de999989a0cc45e5650503d4755bb9ff56e922741d1724747147811657c5d

    SHA512

    82c2e5f68a39906c1b5a29d22544a0545cb51793edcd6b4326f37dbc5dc61fb5d8f848937a6dea4b66594a4c38f3d6974ecda5be7fbd6dad947e936dab7d9dd5

  • C:\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\webview2loader.dll

    Filesize

    113KB

    MD5

    80243b7f55a36f54b0c1c3735e883861

    SHA1

    06800e33619b24c60292aab984df47489ce4d64b

    SHA256

    7cddfcd327290d5f1b997ea9636a4595b5188c8a5ab495a4251bad46709a0c62

    SHA512

    06dd2a24e898d11dbf3b03df208ac9822e4ccadd6a38c424b17ed94cb00b1372ba5794fe4fa93ddf7175455c950301c0bcb3134748d5494f089d01fe8c68ba07

  • C:\Users\Admin\AppData\Local\Temp\MiniChat\Chat\Dev\blank.gif

    Filesize

    43B

    MD5

    325472601571f31e1bf00674c368d335

    SHA1

    2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

    SHA256

    b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

    SHA512

    717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

  • memory/3732-33-0x000000000A940000-0x000000000A9F2000-memory.dmp

    Filesize

    712KB

  • memory/3732-1-0x0000000000510000-0x000000000097C000-memory.dmp

    Filesize

    4.4MB

  • memory/3732-16-0x00000000053E0000-0x00000000053F0000-memory.dmp

    Filesize

    64KB

  • memory/3732-17-0x00000000058F0000-0x0000000005C5C000-memory.dmp

    Filesize

    3.4MB

  • memory/3732-18-0x0000000005D80000-0x0000000005DBE000-memory.dmp

    Filesize

    248KB

  • memory/3732-19-0x0000000005E00000-0x0000000005E08000-memory.dmp

    Filesize

    32KB

  • memory/3732-20-0x0000000005ED0000-0x0000000005F8A000-memory.dmp

    Filesize

    744KB

  • memory/3732-24-0x0000000005F90000-0x000000000601A000-memory.dmp

    Filesize

    552KB

  • memory/3732-27-0x0000000006230000-0x000000000623C000-memory.dmp

    Filesize

    48KB

  • memory/3732-28-0x00000000064B0000-0x00000000064BA000-memory.dmp

    Filesize

    40KB

  • memory/3732-29-0x0000000006850000-0x0000000006878000-memory.dmp

    Filesize

    160KB

  • memory/3732-30-0x00000000068A0000-0x00000000068C8000-memory.dmp

    Filesize

    160KB

  • memory/3732-31-0x00000000068E0000-0x00000000068E8000-memory.dmp

    Filesize

    32KB

  • memory/3732-32-0x0000000074FC0000-0x0000000075770000-memory.dmp

    Filesize

    7.7MB

  • memory/3732-0-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

    Filesize

    4KB

  • memory/3732-34-0x00000000074D0000-0x00000000074E2000-memory.dmp

    Filesize

    72KB

  • memory/3732-35-0x00000000074C0000-0x00000000074CA000-memory.dmp

    Filesize

    40KB

  • memory/3732-15-0x0000000074FC0000-0x0000000075770000-memory.dmp

    Filesize

    7.7MB

  • memory/3732-391-0x000000000AD40000-0x000000000AD62000-memory.dmp

    Filesize

    136KB

  • memory/3732-392-0x000000000AD70000-0x000000000B0C4000-memory.dmp

    Filesize

    3.3MB

  • memory/3732-404-0x000000000B1F0000-0x000000000B1F8000-memory.dmp

    Filesize

    32KB

  • memory/3732-405-0x000000000B220000-0x000000000B262000-memory.dmp

    Filesize

    264KB

  • memory/3732-409-0x000000000B460000-0x000000000B470000-memory.dmp

    Filesize

    64KB

  • memory/3732-412-0x000000000B510000-0x000000000B5A2000-memory.dmp

    Filesize

    584KB

  • memory/3732-414-0x000000000BFE0000-0x000000000C018000-memory.dmp

    Filesize

    224KB

  • memory/3732-413-0x000000000B490000-0x000000000B49E000-memory.dmp

    Filesize

    56KB

  • memory/3732-415-0x0000000074FC0000-0x0000000075770000-memory.dmp

    Filesize

    7.7MB

  • memory/3732-416-0x000000000C880000-0x000000000CE24000-memory.dmp

    Filesize

    5.6MB

  • memory/3732-417-0x000000000DFB0000-0x000000000E136000-memory.dmp

    Filesize

    1.5MB

  • memory/3732-418-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

    Filesize

    4KB

  • memory/3732-419-0x0000000074FC0000-0x0000000075770000-memory.dmp

    Filesize

    7.7MB

  • memory/3732-420-0x0000000074FC0000-0x0000000075770000-memory.dmp

    Filesize

    7.7MB

  • memory/3732-421-0x0000000074FC0000-0x0000000075770000-memory.dmp

    Filesize

    7.7MB