Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
30/05/2024, 00:07
General
-
Target
e2c2fc19d78cad54b301d7a0614e70dd512a9230c66b3b4948f33611d44872ab.exe
-
Size
73KB
-
MD5
da24f0b0d6d94f2d918c62e4ad77ec26
-
SHA1
79a6e94481e49c42ea2ea76a72460d726c8b2f01
-
SHA256
e2c2fc19d78cad54b301d7a0614e70dd512a9230c66b3b4948f33611d44872ab
-
SHA512
b06b4c3cc29aa93b8156a733fa17c229e2e799653cd0245e5529612515a0234adcc4fe6ad8db412cc0a17083efc27e929d3d6edde5871fea85197b64f28f4805
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOn:RshfSWHHNvoLqNwDDGw02eQmh0HjWOn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c2fc19d78cad54b301d7a0614e70dd512a9230c66b3b4948f33611d44872ab.exe"C:\Users\Admin\AppData\Local\Temp\e2c2fc19d78cad54b301d7a0614e70dd512a9230c66b3b4948f33611d44872ab.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5a497cf74e347c5763705e1eb7900ff9d
SHA1ce436b013e45047d18a7dac6f05ba3944ea28ea4
SHA256c37f0a1d4afb6069733f0819c69340b117d0fbe04d5d1d56b37cc8fe9bf1f8f1
SHA5125435e0c1fc280fbf0347fa99a86e5a78435d527f73f62c5c6824bd81a9dda4a474db1dedca9ca6250c5c67b02eef2424b8eea2563cef2d149de3426e4d7af7c4
-
Filesize
81KB
MD5a86db33e1d00f8e5d428c4973d7298a4
SHA1a23273e612ab1704bea6dd87933158ca2c738632
SHA256fd98ce6dac0d22ca7aa3a5b13ac172615c79856a54773916e0cc88039ba051a6
SHA5120fc8a1964d868056500b04a6a9e858170eb0403132404a8c1abee8426442250a3f5b4817dea4a77279b797681298fb7abba7dba54c3f345ac0ea151041fb676c
-
Filesize
86KB
-
Filesize
86KB