Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 22:29

General

  • Target

    8b57a1d2bfca240ce684718b75d941f8ada7ead8b1b8e53b69d4ebdf25ff5c60.exe

  • Size

    3.2MB

  • MD5

    d5eeb66f735c652f2ae14fb370b08dc3

  • SHA1

    7d67975cb829c16218a74dcea1af65b9fbd61a67

  • SHA256

    8b57a1d2bfca240ce684718b75d941f8ada7ead8b1b8e53b69d4ebdf25ff5c60

  • SHA512

    c3418366dceab148f3c35acca874fb94865aeef09775994fea7dc8d3aa9dcb9b0498abcd8321582891aacea19966c842e5fcf39ec87919b4afecbc14c570f33f

  • SSDEEP

    49152:t3C3EKGJxWmTtcckaI5uJz9lNi8fxHM+5YjCpVJJJJDX3BG3UF2Ak:tE+VqElo+xHM+5YjIXpk

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 53 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b57a1d2bfca240ce684718b75d941f8ada7ead8b1b8e53b69d4ebdf25ff5c60.exe
    "C:\Users\Admin\AppData\Local\Temp\8b57a1d2bfca240ce684718b75d941f8ada7ead8b1b8e53b69d4ebdf25ff5c60.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ImageOle.dll

    Filesize

    69KB

    MD5

    c653904916e99c2653bf3b339c734f05

    SHA1

    6cb3cde5b5f7ffd76b0de150feb15801f705dd57

    SHA256

    a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

    SHA512

    d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

  • memory/3720-0-0x0000000000400000-0x0000000000730000-memory.dmp

    Filesize

    3.2MB