Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
Resource
win10v2004-20240419-en
General
-
Target
1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
-
Size
4.4MB
-
MD5
c96e728ba7febe27e85b9acc04ddbf2c
-
SHA1
de8c3ff03cdf8a32bdb16fdaaaeff4b68fab72a0
-
SHA256
1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308
-
SHA512
f7606c02954b87b964cbd1aa208330fdc0af42e959d30fe64bf908647fb3efa241dd94b534ec4bd1f4a3fb07ba086702dfbbb96fc6b4d4e2032d56df27f25bc3
-
SSDEEP
98304:AyJOZ0Fb32Sh4H8U5I49z0Uwk3kqXf0FF5v:AyEZMhmPI49d13kSIFF
Malware Config
Signatures
-
Loads dropped DLL 9 IoCs
pid Process 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3732 1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe"C:\Users\Admin\AppData\Local\Temp\1ab6ed17a955c5da7b3341ed7c5af8c8bb956cd6a00382ecb3babc832934f308.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3732
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.core.dll
Filesize538KB
MD5f1dac51a74f4799838be29934a288c5c
SHA11e3ef5deb4e3f7a01656fbc3b7833276c3297a2f
SHA256a7baa548c354ef9223f4fd19d2bae33c3eb8cb987bf7b577828897388110740f
SHA5127d2a9f31d41a5f81cadf55961bf7fcc9eaa64393427e530303bc966088978cf28b22a186cb82ba251d82d210a4bd37c753f11e058209ea0e26dd2af91e1db5ab
-
C:\Users\Admin\AppData\Local\Temp\Costura\03F70F6D8235AE0160301AA5D72B0F83\32\microsoft.web.webview2.wpf.dll
Filesize46KB
MD59022d0f3e7b23ac1525b01d339582bd8
SHA197919a2bf43a7f3ada9fecb1fc9e6d5cc673f46c
SHA256ba0de999989a0cc45e5650503d4755bb9ff56e922741d1724747147811657c5d
SHA51282c2e5f68a39906c1b5a29d22544a0545cb51793edcd6b4326f37dbc5dc61fb5d8f848937a6dea4b66594a4c38f3d6974ecda5be7fbd6dad947e936dab7d9dd5
-
Filesize
113KB
MD580243b7f55a36f54b0c1c3735e883861
SHA106800e33619b24c60292aab984df47489ce4d64b
SHA2567cddfcd327290d5f1b997ea9636a4595b5188c8a5ab495a4251bad46709a0c62
SHA51206dd2a24e898d11dbf3b03df208ac9822e4ccadd6a38c424b17ed94cb00b1372ba5794fe4fa93ddf7175455c950301c0bcb3134748d5494f089d01fe8c68ba07
-
Filesize
43B
MD5325472601571f31e1bf00674c368d335
SHA12daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
SHA256b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
SHA512717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc