Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 23:09

General

  • Target

    $TEMP/keygen.exe

  • Size

    1.0MB

  • MD5

    d46b062d7f8ecf948d579ebe809cd597

  • SHA1

    bba400b955bca8729bfdffb343d3b9f54cbb42f3

  • SHA256

    9dca86bab19f5f0cd7c71ac4797921c93c03894f2378b8b3f4e97d742c9c2ea3

  • SHA512

    2c93a1e061a9a77b5c4b5ba8e5f6b4809f225c28b9279cf341c54b8cb586834c7e1ca583df8d8ad4ce8458fcdee306b9f43043b5c2e3f9441f024b4591ce7d49

  • SSDEEP

    6144:bcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOhn43xFLNhBa41v2jrPzYjYXlMyhQ:bc/kEPDonR6Y436vRrynhSlMyhq8uH

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\keygen.exe"
    1⤵
      PID:2560
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x500 0x31c
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4080

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2560-0-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/2560-2-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-1-0x00000000005E0000-0x00000000005FF000-memory.dmp

      Filesize

      124KB

    • memory/2560-4-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-5-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-6-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-7-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-8-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-9-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-10-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-11-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-12-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-13-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-14-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-15-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-16-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-17-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2560-18-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB