Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 00:29

General

  • Target

    5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe

  • Size

    74KB

  • MD5

    6e60e0a26419e90b8876f02464a2e880

  • SHA1

    34890edc24eb8abacbbcfc88eee6ebf5a84ae6a7

  • SHA256

    5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa

  • SHA512

    ebdfcd2783dd78fc57df73a44bdf289263d50fcf1dcd62d4049e5a679e3b4bc86d8b194d8f961805a2d77444ce514aadcc183398feff0209cbfde2c695cff0c9

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOrl1:GhfxHNIreQm+HiYl1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe
    "C:\Users\Admin\AppData\Local\Temp\5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    75KB

    MD5

    8b2a1f300833c4da604cf9fb02a92451

    SHA1

    8d8b2b8089711bb8533d42b0b1187c45aaea2a88

    SHA256

    4a9465875085e8e457acc11eb47ee987793dc95de9c056a2a5fdc35bea9de599

    SHA512

    b17bf1e4e65ee984c6d9df1aae3362136cb8b29351b7b3c672500f236ff186fcc7dea257ec7d2d6f5154461a263dc7d7d5dce70a530f495a16d6527f5740d490

  • C:\Windows\System\rundll32.exe

    Filesize

    85KB

    MD5

    2c9537a827804a1d58d3e0c96753b70e

    SHA1

    c4d3c46821c1cb7c66732a8a3d062915bcfb1565

    SHA256

    231ec27d977ceeb9017fcfeab3796c9f9fe53915439ae7826ebc1c5a6a45052b

    SHA512

    f53430f67132d0d6ea70520bd9e0157869c28bab54622212c808ffb4d00d37f6818ef82771f64ee2250e0d6496405a7041a6e8359d8b7bf3ab8143537be39dba

  • memory/2364-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2364-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB