Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
05/06/2024, 09:26
General
-
Target
77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977.exe
-
Size
4.1MB
-
MD5
c6e5f3f5ba9ae8fb70f73fae8b2172fa
-
SHA1
9719bb8ddd55e4d5105685a2a3ac5b80c01b4ac8
-
SHA256
77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977
-
SHA512
b8c82c9a1b3428604efda7e9083e396cab41b126769ad6d26d60b9ea432f14023a56cdbaab27cda46f6c95346f3efdb2abd5ae5b46afa9abd6c663a26cd25a4b
-
SSDEEP
49152:Pmmk1H6gBnOpek8EZp5OPycC5rcQq8oy7auZzyDxItd1Eh5qwlRxvNHhYNVTKG5j:Pmu4nOkO5v5w/8LJ79q8cQVeWC/3Mn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977.exe"C:\Users\Admin\AppData\Local\Temp\77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977.exe"C:\Users\Admin\AppData\Local\Temp\77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977.exe" -gpipe \\.\pipe\PCommand97Getscreen.me -gui2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977.exe"C:\Users\Admin\AppData\Local\Temp\77d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -cmem 0000pipe0PCommand96Getscreen0me5ya54o8750pz5kl -child2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Getscreen.me\chlxrbadyixompyacbacfksupkncckh-elevate.exe"C:\ProgramData\Getscreen.me\chlxrbadyixompyacbacfksupkncckh-elevate.exe" -elevate \\.\pipe\elevateGS512chlxrbadyixompyacbacfksupkncckh1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5c6e5f3f5ba9ae8fb70f73fae8b2172fa
SHA19719bb8ddd55e4d5105685a2a3ac5b80c01b4ac8
SHA25677d6b48b175a9ece403bc236ec744801c67ff6addcb712c36754237cc2e41977
SHA512b8c82c9a1b3428604efda7e9083e396cab41b126769ad6d26d60b9ea432f14023a56cdbaab27cda46f6c95346f3efdb2abd5ae5b46afa9abd6c663a26cd25a4b
-
Filesize
3KB
MD55436c3babc4b99ae8ced44c5a019691a
SHA160acb4dca22a598d09e256fb3a025813acd6b2c2
SHA25663691908720ff06952c4b63e60ef60315ae9b84b9547069372585932a19a7ec3
SHA5123b343b5460e0b4aaf6c8bed7588827f7b45fa804d86c4cd0969ccd58ee61b44b325c366dcad0081b488abfc783f27758f370180902df0dc06d519cba52744586
-
Filesize
261B
MD5b9173876111eb14380f7e355c0875d47
SHA10ab71dd898ed0118d02dcd871d99c0bbbfb471dd
SHA2566ca6564af663d71b35d172873a5a438979c65ff6cbb4be16586ce8fd4ff3c652
SHA51293d7ed62f6e6bb96d4f2b79598b7ec96e7dcea9cf24a8ed7f6924ffb3fd0ae477586ffde0aceaa822abda76c4066147650c5ada3a491b0e049c76cdaee683032
-
Filesize
667B
MD53849ff8c8a9e1554e42c37db70f46dcc
SHA100ec564b73bf137e63e5b83e4dfa76b7bfc8ac93
SHA25663abb9d1301d3f7bf75c1bbe947477570717df2885b0ae7f48b220129a37c73e
SHA5126b54e67dd4f0a3d0b57ab27d61f0b1403c86ba8767ec7d64e5ddc1b9860b9cd30d46d78bbd8e7490c8d73d4886e1e47fd1146a3f5cbb359255f6823b947de7d0
-
Filesize
16.0MB
MD576e060e929a27a8f50a5ea6edfc52356
SHA191b7bc99d759d84720b376f69bc934d75d9ec549
SHA25695f95f6678ad42de249fe02f78472b553837b1e2aecd2f43b5715fae9187feae
SHA512f1a361f28a87b18b8b5707bd3332e751ee30dfc5c9a32a4bbc39b7e8d5ac34385e96b49546003741a797c1a8e53537a91d5345dfcb1707bc65a483d458fd38fe
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB