Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 04:39

General

  • Target

    94e1cdfefd5b040c3dfce4f03d5828c9f8244dbde4582a54726471d5b8e200f8.exe

  • Size

    80KB

  • MD5

    5c875f61da10828796ef36e740905891

  • SHA1

    ebdc7934c3ad2bc3e224baa668ab1db0670119cd

  • SHA256

    94e1cdfefd5b040c3dfce4f03d5828c9f8244dbde4582a54726471d5b8e200f8

  • SHA512

    54b22a833e5824a5a63cb3ae59c606a519cc7f6175e26eef205ad4ca1fa1fd27b4bfa034589946920876d4a8b7940e75676683d23dd8833a028eea5fc7c403b1

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOgv3X:GhfxHNIreQm+HiZ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94e1cdfefd5b040c3dfce4f03d5828c9f8244dbde4582a54726471d5b8e200f8.exe
    "C:\Users\Admin\AppData\Local\Temp\94e1cdfefd5b040c3dfce4f03d5828c9f8244dbde4582a54726471d5b8e200f8.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    75KB

    MD5

    8e9e7b6665d5a21484a2b64759b086a9

    SHA1

    2ccbe60e1c93e77aa0cdde18b7c39c63dde2f1af

    SHA256

    ca9cd6b6f2f2850e38d4ed81a062ee98d056bc2d5e465c81f079f17b6252290a

    SHA512

    3dc24c2e15b18e1fafca1055149a1869c14169432d5bb44d3d5b8a84afaa54223e3e51641b5eb4d8f24aec16392b8587d2f66be63f7a15ba4c4c576e2191c8bd

  • C:\Windows\System\rundll32.exe

    Filesize

    78KB

    MD5

    d6a5d43a931d71ccf6c7583b7ca38894

    SHA1

    6b9363bab4a0d7058e25d9ccd85f51e073ad1024

    SHA256

    c66c659018a934371d024ec5b255c42c2a7054e61af2a7dabed8d62794d016ab

    SHA512

    202ea35681838c3a4d24fe5ab8a1529476a292cbc9c93d4a4660d57834f5894c918391a8e2e50e1d3edcd3c2656a86acf8ac4d061a4ad81bdd7163a732ba9ea9

  • memory/5016-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/5016-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB