Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 04:47

General

  • Target

    7acfc0f7c3e424d1e01bc74c15b86c3961f9ddae5950419a3a35e460dd03035a.exe

  • Size

    83KB

  • MD5

    f7ff0ba605d1a9c0a34e5d7b4c9c3184

  • SHA1

    192e69570dde2ae53ee83a54686af39e8937188b

  • SHA256

    7acfc0f7c3e424d1e01bc74c15b86c3961f9ddae5950419a3a35e460dd03035a

  • SHA512

    679db2c1f143d91691a9cf0daf97d91d2c9317973409e25be191939d41dca7b2a7021148b4d309c95a430a219ea6d527fdb05a5244531e6324ddaeb3bb7aa10c

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO247KJFM:GhfxHNIreQm+Hi747KJFM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7acfc0f7c3e424d1e01bc74c15b86c3961f9ddae5950419a3a35e460dd03035a.exe
    "C:\Users\Admin\AppData\Local\Temp\7acfc0f7c3e424d1e01bc74c15b86c3961f9ddae5950419a3a35e460dd03035a.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:4660
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2052

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\notepad¢¬.exe

      Filesize

      77KB

      MD5

      3b42ff4a685dc780e4aa4ff22cdd9b22

      SHA1

      b6041b672cf48545ab3580b85725c9f2bf078abb

      SHA256

      fbd5042adce2c89fc66a8db783a820d277bac844be78c006a2f4cd9f833ebb20

      SHA512

      0fa58b350bc33ca50b2cc2f92d676b4e695b9505027e3695227ddff1e38efd49b467d4533b6edd9f71cda0422a93f35fda3840631a679feb53592d0aa134c2b9

    • C:\Windows\System\rundll32.exe

      Filesize

      79KB

      MD5

      2ee4c03249fee21f225f4eca24c0c2c4

      SHA1

      0597594e1b192db58145acef4e3fa59fa7bbd9e3

      SHA256

      c80ac839960867719610c77501f0d08233dac7a71537b6bc7d674df7346e9995

      SHA512

      aa6c90e5dd11910ff7992bae85678c502db944d60e9fb996316e0d2ce4f3dea8ebe9203b18a6c4497831275d832e1c0bce79c51f1e9e4bbcab8235b60137d5b7

    • memory/4248-0-0x0000000000400000-0x0000000000415A00-memory.dmp

      Filesize

      86KB

    • memory/4248-13-0x0000000000400000-0x0000000000415A00-memory.dmp

      Filesize

      86KB