Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16/05/2024, 07:32
General
-
Target
958c4f1f63aa4b0916c3443e86ee5c4b.exe
-
Size
85KB
-
MD5
958c4f1f63aa4b0916c3443e86ee5c4b
-
SHA1
94b33d97c41f88a5363688fb753ff21df5dd41e0
-
SHA256
f20585f92942d4406423ebe1257b5eae8a460721e00bea42dc70ec948bd49f2e
-
SHA512
b7d12d0d0ce224dca54f1819c485d1e10c53f0d2ce57f9815f9a829770e3dc21697659e0cad3dae426d352a1892d6c8b2cda7a85bc065b07b6254035a0247d0b
-
SSDEEP
1536:ygLGdUFcYJnl3lU0PY5lZCXS85X2WlDeSdDatDRZl3pZduO+drmM+qckIt33+ld6:ygLGdUFcYJnl3lU0PY5lZCXS85X2WlDA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\958c4f1f63aa4b0916c3443e86ee5c4b.exe"C:\Users\Admin\AppData\Local\Temp\958c4f1f63aa4b0916c3443e86ee5c4b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c C:\Users\Admin\AppData\Roaming\TeamViewer\958c4f1f63aa4b0916c3443e86ee5c4b.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TeamViewer\958c4f1f63aa4b0916c3443e86ee5c4b.exeC:\Users\Admin\AppData\Roaming\TeamViewer\958c4f1f63aa4b0916c3443e86ee5c4b.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5958c4f1f63aa4b0916c3443e86ee5c4b
SHA194b33d97c41f88a5363688fb753ff21df5dd41e0
SHA256f20585f92942d4406423ebe1257b5eae8a460721e00bea42dc70ec948bd49f2e
SHA512b7d12d0d0ce224dca54f1819c485d1e10c53f0d2ce57f9815f9a829770e3dc21697659e0cad3dae426d352a1892d6c8b2cda7a85bc065b07b6254035a0247d0b
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
24KB