Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16/05/2024, 02:06
General
-
Target
ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0.exe
-
Size
218KB
-
MD5
b3b557bfd1a5553e6b4fcf82c82314cb
-
SHA1
1b2fb11b0393c81865de45946c5c2f714199aaf4
-
SHA256
ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0
-
SHA512
a4b402346321456dfe363193b415c7651a18106be0d732712b8fcc58f85c2542ea5d0ace13e6458f6eaf5158fab4257273b2d33d37754f5aecf64b1e0609bb82
-
SSDEEP
3072:xvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:11SyAJp6rjn1gOObn4b6h9h
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0.exe"C:\Users\Admin\AppData\Local\Temp\ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD52393c57e4df48f1fbe0febb752faad04
SHA14887793b464b9f3e1afd24a9377b55ab5a5f3a72
SHA2564046013e1287cb556533a2629355b575f241f1d30963c6b143b6ee27f0a63bae
SHA5123d48f0f22016f1af7eee915d37b0c6581ad9212041a89a2d9fdd23da494367ebca9fb6e63474335f76fa7755f27283f0ae59e4caed25d33a4bb0e7c028659a94
-
Filesize
42KB
MD550889b6ddfc376a78e64f35d9d105e9a
SHA1f8ca33b10fbf2ded07722993464d0b644bb1549b
SHA256222efc81bbe49bac8a63d957f0e3f3b2d7e1cf458dd42d88f6670347b8f8a8a6
SHA5127f21b782c1c4819b1b242dedc800aa5d0e6ce0e192fbf412668100fe09e3df5c393e3858221f28a415dee87cd88c802ee5ad5fe17dece598ba50887f0b8999ac
-
Filesize
481B
MD5ed6721d1092cd2493f776542e07b3f25
SHA175d1f96280728ff17f4effc7d4d9228a47a70e93
SHA256499a1881a1d5e29d2a5049829e0ff429a15ec72eda460c604f9a2ce251aeda26
SHA512cde9fe33865729939699d59e01de2eb38b7b5bd92d0125a0c9340ae0051368abb77e97fac2af5ffa2b8d4f0dcd4351713b886aca8f94d43b923208a38714e848
-
Filesize
457B
MD5531ec87a0b2f9477a52d88b111d0d46a
SHA150a72e5752075309f91c062e0282a7e7cd1e751e
SHA2564875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385
SHA51207994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1
-
Filesize
218KB
MD56ee5d38ec6c34550ecd05184e602b624
SHA1a74fd1b6327450e050c2d0ede8c5259879570eee
SHA25661199f85d80ff5385ce7ac9b6f48a0eb2733e7d9e410a83c075f983c49d5b247
SHA512f3a7ff7660487f53cd00d7c275d78b592aab115e1c1341d069d88d9b53c66b28a21558d9bc50d5601b825f161775a8e8f2a3624da6db9e9fda04190c2be6fde8
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB