Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
11/05/2024, 01:58
General
-
Target
c01d8c10fc3471a126736e3baa5a5e2526ef756d53b913c6be8f9a2c2f635eb7.exe
-
Size
168KB
-
MD5
213624e4547432f6b8e30670eddaafc9
-
SHA1
3a65c13e112b200bc4b67ea846169c4fd2dc4fd0
-
SHA256
c01d8c10fc3471a126736e3baa5a5e2526ef756d53b913c6be8f9a2c2f635eb7
-
SHA512
a79af212a2e163c933dbdf6817b10dceec888af00cb24f9660fc20e7d0f58278e3a979af5d3d33786c9d4828b8be93014f1f01bd9c1de1bcf28fcfb8e1688b5c
-
SSDEEP
1536:1EGh0oEli5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oEliOPOe2MUVg3Ve+rX
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c01d8c10fc3471a126736e3baa5a5e2526ef756d53b913c6be8f9a2c2f635eb7.exe"C:\Users\Admin\AppData\Local\Temp\c01d8c10fc3471a126736e3baa5a5e2526ef756d53b913c6be8f9a2c2f635eb7.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDBA7BF5-144C-4ee9-8FB6-A28D9205E6AE}.exeC:\Windows\{BDBA7BF5-144C-4ee9-8FB6-A28D9205E6AE}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C32D40B-8D9D-4f97-99FD-7E5ADB6EFD9C}.exeC:\Windows\{7C32D40B-8D9D-4f97-99FD-7E5ADB6EFD9C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{873EFC61-5D37-4c38-BFE8-CD01D532539D}.exeC:\Windows\{873EFC61-5D37-4c38-BFE8-CD01D532539D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A3EC5D4-3C24-46b5-B344-8147F72B4B94}.exeC:\Windows\{9A3EC5D4-3C24-46b5-B344-8147F72B4B94}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D23EB018-6F1F-4a49-8351-2D23282782D9}.exeC:\Windows\{D23EB018-6F1F-4a49-8351-2D23282782D9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C3F551E-A889-4993-9A0C-32A3CAAA5698}.exeC:\Windows\{7C3F551E-A889-4993-9A0C-32A3CAAA5698}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB5E42D4-DA59-4a28-842B-7C5F1FF1C084}.exeC:\Windows\{AB5E42D4-DA59-4a28-842B-7C5F1FF1C084}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF368784-92FE-4aac-89F5-BE1DA0CA9A8F}.exeC:\Windows\{DF368784-92FE-4aac-89F5-BE1DA0CA9A8F}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75A9C215-377C-44a5-8CEB-C4D85123B0CF}.exeC:\Windows\{75A9C215-377C-44a5-8CEB-C4D85123B0CF}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAAE3A47-F6E8-41c5-A02F-2530BC0AFB30}.exeC:\Windows\{DAAE3A47-F6E8-41c5-A02F-2530BC0AFB30}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AB4A419-9864-4ec2-BA28-0F5842E188D5}.exeC:\Windows\{7AB4A419-9864-4ec2-BA28-0F5842E188D5}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5FDDE200-767F-499b-9B00-1AA2D418645D}.exeC:\Windows\{5FDDE200-767F-499b-9B00-1AA2D418645D}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AB4A~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAAE3~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75A9C~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF368~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB5E4~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C3F5~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D23EB~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A3EC~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{873EF~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C32D~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDBA7~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C01D8C~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5c2c61fce565263189647b5974fccf3f2
SHA1b62d1071833af5b9f2bd19aac2f69c62da5bb895
SHA2569d520b391bdc9fb37129ac1f5da4e07a443e18e62fc64c660741a07a2b87d4cb
SHA5121a3149a529584b0cbcf86fc85684447188c5e1ace61fc028c82b7e7fc7231a5ff52cdf0c6a2316636f841a65fba30cbc19a7ee24de4858c26f8d62633f89716a
-
Filesize
168KB
MD5fa2f1a1912f75e616e6bb035f4510ff0
SHA18b275b76a5764f3974818c9e02ac9c63c63f84c2
SHA2569ea7e7f58047c8581a39579ebe85ad215930e8bcf822533f5a593a64ca8ebb2d
SHA5123506d6bbe8377d019e2ddc7a11021c483c46b6f487a9d11640821abdc628f0e3582cde26a543c6f1b9cdc1f4a15c35d2fe325666419e4c0e22ed6e9a5fd2be0b
-
Filesize
168KB
MD5be0641f7cc9f89130b8eb58f0650a010
SHA117819a89817da1ff0f0078daace2572a8fd81648
SHA2563d0298ef2a911e3aed7991528e32530772ea451c48d3a6f73e6acc9c5818241c
SHA512c64a55ffedf7e5c25e2043f5d93c2c8a9be1448fb240291eb302d9740b7fbe29c67de2884ad4a08b78fc10d64ebcb1723b063faec457bd2565f63b89718cf215
-
Filesize
168KB
MD58d5fed0dce6ec7d033bc87706393df99
SHA1e3c66aff963293e1d8a55a41fe1b8497c40bf5fc
SHA25612c564b4b09b98c7e548816c84372c7d6ed8f4921fabc6fa8e5c04a71c0d5ffd
SHA512afd5d9722fca368024ffcdd1761853bfece0eaaf663b2b7a1f894d3a21aba0c4b9b37491323a80893369fdeff63a23b1fb5b0458f13e194799d70e26dc7e3ff5
-
Filesize
168KB
MD5fc6b11ef3eff1b809488197694c835f5
SHA14912e3f8d7874d803dd5af7341421a38070551b7
SHA2565016cb2e7c479b729efa240caa504d13f2fd604759635108b61fbcd0662575ca
SHA5120887e1ef680707721205f612a4f0da964bb3d0707ec2cbba43fbdbbe7a33dfa1163432e5bfd8ab74c7483503aae79067951aa336a6725bf74ebf94be9344df98
-
Filesize
168KB
MD508a91ac796cfc8cf7fe5d528fb99db6f
SHA13f78bf842e7d3db8a88c7d43571c365010abecd9
SHA25627c1e8608783fb7c924ad36b786efd3997bbef61d2776c0b458b46af5091bd8a
SHA512b7681a8aa54fb243af89ff04177a19d7b028c5c737c16638458cf2da38ce5871b01e304515ffd7c4b734e2f601e6f83d1bff8db7668c206bdac3efd07b0e0a96
-
Filesize
168KB
MD586c0f1a9808af19f312d8342ab1800b0
SHA17f9ed657a81124cfbf709307ed9441c9aa939130
SHA256e16d8591328d6c2f9a1ddd8f9a55919bed38d935781a59040ce981dc3543f4ed
SHA5129cbf0c8dafa743578d2fa284ddba3a64fe2d6973af1dfc6d3fecddefb5bf983ceeb86c48a3e8d0245a130acddffbce25a46d5f033c4d5ae3c69d581e97947681
-
Filesize
168KB
MD54387af4f265e858c88cec81210e7efb3
SHA181e16b9beb1df0049c7bb5b994c57c96ae786544
SHA256606304a03e9f8c4066853025d96ef37c2af9a3635371a79582e551ed0d21ec3b
SHA512c3bc74dbd48679fe864d0d9d40d2bcea526ea23b676fd7d8f08cfdc8f082d9c47b6672677c42543b85b501d4584384ade6f68a0eb213a47681d1f4140e78729a
-
Filesize
168KB
MD522a6bacdfce06bf4cff1db3a9b42bf36
SHA12539110664cd1b76f2929908c1f2c0b7b5447cc0
SHA256f0ccc149e2a5c0c9551591948cf7e9cf9863a9f86ce0854ab8731f52a5039308
SHA512b368b648ebefafe1ea15ff9478c42cce59a6f33d3e1785ba7dee256f0f920ae8507be166236e92e11dee70f8a774a631d79dd72c8fafa63e07b48ab7ce75c892
-
Filesize
168KB
MD54b20d89428d68b9ca00ac255c0992b96
SHA1928babe4dcf5c34267ce32f6e65b9d1a5dad7ad4
SHA25675fd163e5686213eddaafa220e65f9220f179a42594723e57fb75ef784c7fb16
SHA512c32b821d76195a633ef563bb94505d3f487d791175743b9ff659fa481341a6e9f1e296f6e22c269d39367387c80bce4be0e79b173143144297f35715b3ea34ef
-
Filesize
168KB
MD57284c97f21602f792bb2d8bb09a93586
SHA1b4c064c439da39ddd5f91adc7265e0ebe0d00f6e
SHA256eed71b430e8842429738e5f94d02d63a1923a126cd04f0f1415bf19f366285e1
SHA512df6404ab8dba6b9a54efe2512f1285b5674a88b363c38a46cdd8307afaff4a605bb6c0f6e36ee5dc33b8a622ad64444e5db3137082aabfa4078b972ed6f9ff49
-
Filesize
168KB
MD5aec7925c8ac2058510620f54a243badd
SHA156be9b77f7be0e91c4fcda31baa5ef4cdf62646f
SHA2567d18fd6d28d733b548c67af38f44f81917b67bed868472c3b562fafe57d00767
SHA512c1d65edb592c6382cf15da5fea7569731663d98940cd6b60b62f8be3c660a105defefb1cfb3fc464a57266b2019f829dc0fc426a8331414d9d5163343efdeaa9