Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
04/06/2024, 02:32
General
-
Target
b2a40f27de644a0a463c281792a24bbfff9bfc57f596bad9cebd6bc4eeabeceb.exe
-
Size
81KB
-
MD5
40c746820016e968f8457d60aa63632a
-
SHA1
bd59435f4b44c95a577d2b8a60de22ced3b86ada
-
SHA256
b2a40f27de644a0a463c281792a24bbfff9bfc57f596bad9cebd6bc4eeabeceb
-
SHA512
735a39573af74df9536614e18dbb87c7060498d5502b84ce6ec69526a1f358a26347ab957a64e1d12f1c9fdde1bfa324d125bbd7784747bf51a151140accf628
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOtxytmvj:GhfxHNIreQm+HiWxytmvj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2a40f27de644a0a463c281792a24bbfff9bfc57f596bad9cebd6bc4eeabeceb.exe"C:\Users\Admin\AppData\Local\Temp\b2a40f27de644a0a463c281792a24bbfff9bfc57f596bad9cebd6bc4eeabeceb.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5f9053a5ec352b99bbba37f36458c3b97
SHA19ae144908c1e02501631f53c0fc222d776ed302f
SHA2560348f4c559fe0eab3a1ce7ece6cf356a4768d6dbcd5a8d080dba238bec3f9170
SHA512e0b67cc05455d992bea6194a3cad9c3c25f1d18865bbed70ab5bfa9df76adb2ce755145b25e537cebf06d056d828fa14be7d5dee44ea8fcde3dc575d74e10520
-
Filesize
85KB
MD53386c7ed909b92d1b2f8f4d06f2575f0
SHA196f8a5b0876d4785a628e0c98ac0abd9cfe1a8f7
SHA256c8e8e8e51937c8dddbefc949074fba8557c6951a455a48fbc36191b38feee1a5
SHA5127e904a0f9e806b1765feebd97b1c243db2e44e04bde236e41201601c7a6603fd33adbed4e5c22acb27c8b01db957ccdbe06023d6e16145730a3f75e2999ed6c8
-
Filesize
86KB
-
Filesize
86KB