Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
02/06/2024, 23:18
General
-
Target
6e2eb9481bbca637c22725ab53fd7005ad011c55ce02d804f812da6790a9bede.exe
-
Size
3.6MB
-
MD5
6145e3ebc882746fb2414ccad1ed4ed9
-
SHA1
20471c3b4120cc056dda6a7a4a1a8a2c4209d2d0
-
SHA256
6e2eb9481bbca637c22725ab53fd7005ad011c55ce02d804f812da6790a9bede
-
SHA512
5ddf6d066d2ca1e8a2134f04ecf2a987f07344dab615d66713b3cb9dee0fad8f0f27cc4fad2e71deace1615a04ae4b3126a8cafca5aed5430742101debea1151
-
SSDEEP
98304:JdByXcdnlLwOrI5Vfeg91hZOhkRpsinjx:Jdien+OrFuBR6cx
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e2eb9481bbca637c22725ab53fd7005ad011c55ce02d804f812da6790a9bede.exe"C:\Users\Admin\AppData\Local\Temp\6e2eb9481bbca637c22725ab53fd7005ad011c55ce02d804f812da6790a9bede.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5933c6c8834a853f60bec2496786460a3
SHA13c63e772908ed624146017cb528b625ec8357023
SHA2566061dccc77eb4fa9966bdaffc0fd984bd83cceda34d4fa6f6842becee1de447e
SHA512af07fab6ecbc13c6312436aa42f7045930ed8aa35b3e5dbbfc6b5891a3d87f045f27c60e8d3a7c0a9fb463bd55683718ab5ebbec0e57e5acd007c74dc2312c59
-
Filesize
3.6MB
MD5c2c5982ce694b86cad3a576270c6a565
SHA12223c838d28e3985fca7757376c7ebdd56556548
SHA2568b81e972fd7987caa8a1bef4568341e18a9948babb49037b1bedb6859475cb40
SHA5129c4b37150047646a58860b2beaa76e5f2933e39b3caa3ad81f9332aa4af2a6b2f219d76f6d6c6afd2f4f2c42a8896a8643d1f689f733adb68c9023af4a84e26d
-
Filesize
3.6MB
MD5ee6f7839459a1e29eb42ccfc08a4bbfc
SHA1ceb55c5873b11268256e6926b8e3ac38f1c12f92
SHA25691318436f98e35308411e66ee56e4126eac7221fc923c5575861434e5449dfd8
SHA5120302bffd5d674422af06b775b979d611f6c14f247d864ede4839ed934c758b88e2860f503dbbcbcb9783e1e8d3e8e5f66a6d8ce2a4e49e6589024459e950a5d1
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB