Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09/06/2024, 03:29
General
-
Target
$PLUGINSDIR/Everything/Everything.exe
-
Size
1.7MB
-
MD5
a7067594451cab167a4f463be9d0209c
-
SHA1
1c2b1e5a0826ca07cc0aa8b3d24bad0a41845df5
-
SHA256
d3a6ed07bd3b52c62411132d060560f9c0c88ce183851f16b632a99b4d4e7581
-
SHA512
8fb6e9a82213cc1c371eddc12833b8cad037b800a58a3a3520eb7b14c9e41e61a8bf5db27bd6a79dd8013c51649396feff22436cb7bacf64989552a5a11abbd4
-
SSDEEP
49152:Ohua8pOpRzsOV9bzmkSMDGtsFh29slhcReer+z:Ohudp6xlG6z
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Everything\Everything.exe"1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx