Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 07:59

General

  • Target

    a5aa44a94e1192f5d3986d47c59e2c8dc58c39283d2db7a5d9f042fff20cc9c8.exe

  • Size

    1.2MB

  • MD5

    4b6969036309c402cecc7ab3de3a9f44

  • SHA1

    3a9f6d11ae1c426eabd4fe11ba6185b9c20a55ea

  • SHA256

    a5aa44a94e1192f5d3986d47c59e2c8dc58c39283d2db7a5d9f042fff20cc9c8

  • SHA512

    c82cdb2f2287ff23a9f5466597c1dec0c9cea0ad596ef024c8e0073ec1265f64eb6b549d90839e74dd65b1a61adfdd0ec5fd98a68d434acae1af6b6da28af126

  • SSDEEP

    24576:UEr4+wO+sjOuxy0psfjgVjMKOfM3qCFPZOGCu:U5jEt/X8jCau

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5aa44a94e1192f5d3986d47c59e2c8dc58c39283d2db7a5d9f042fff20cc9c8.exe
    "C:\Users\Admin\AppData\Local\Temp\a5aa44a94e1192f5d3986d47c59e2c8dc58c39283d2db7a5d9f042fff20cc9c8.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:1100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1100-0-0x00000000007E0000-0x00000000007E1000-memory.dmp

    Filesize

    4KB

  • memory/1100-1-0x0000000002810000-0x000000000287F000-memory.dmp

    Filesize

    444KB

  • memory/1100-2-0x0000000000400000-0x000000000046F000-memory.dmp

    Filesize

    444KB

  • memory/1100-3-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1100-4-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1100-5-0x00000000007E0000-0x00000000007E1000-memory.dmp

    Filesize

    4KB

  • memory/1100-8-0x0000000000400000-0x000000000046F000-memory.dmp

    Filesize

    444KB