Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 06:35

General

  • Target

    Pointstone.System.Cleaner.v5.9.1.321.WinALL.Cracked-BRD/Crack/Patch.exe

  • Size

    47KB

  • MD5

    200bd3e2ad1a62b7d674ceb0cdafc56e

  • SHA1

    af1950c02c85027999fdb03c18c67ddfa6b74dfe

  • SHA256

    ad7e9a091c8bdd553d40e106602712d52bf829e93f5026c7010714ca5d46c583

  • SHA512

    9488b7ba2f0f9fbd419fc9131b9672e665598a9c73facf80b1d092fffdab3d19df4f09481a076a4a1b4b3963e905a1419d2d4e4f3e2f451ae9079beff333545f

  • SSDEEP

    768:pawIPifkExpHg2jCW8btTOoCq4yfJSAgVFzcND1/157KHk90bgYlBJXaAEEV+2Gl:paRifkEbAOrsuOD5NV9+gGJAE3GnXOk

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pointstone.System.Cleaner.v5.9.1.321.WinALL.Cracked-BRD\Crack\Patch.exe
    "C:\Users\Admin\AppData\Local\Temp\Pointstone.System.Cleaner.v5.9.1.321.WinALL.Cracked-BRD\Crack\Patch.exe"
    1⤵
    • Loads dropped DLL
    PID:3192
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x49c 0x460
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bassmod.dll

    Filesize

    9KB

    MD5

    780d14604d49e3c634200c523def8351

    SHA1

    e208ef6f421d2260070a9222f1f918f1de0a8eeb

    SHA256

    844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

    SHA512

    a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

  • memory/3192-0-0x0000000000400000-0x000000000049E000-memory.dmp

    Filesize

    632KB

  • memory/3192-5-0x0000000000400000-0x000000000049E000-memory.dmp

    Filesize

    632KB