Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
35s -
max time network
7s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/07/2024, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
memreduct/32/memreduct.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
memreduct/64/memreduct.exe
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
memreduct/arm64/memreduct.exe
Resource
win11-20240508-en
windows11-21h2-x64
General
-
Target
memreduct/64/memreduct.exe
-
Size
290KB
-
MD5
bfbe78d329b87dd1d5ae51707fdf928b
-
SHA1
015c758391b620dee72625ed59b522c06f6457d7
-
SHA256
31689824dd984bd9c0f07c20f05bc253f6d107581aec4609044fddcdd50f655d
-
SHA512
e950551d53e50a0296a60730c0cc2ee029ef9026159e159bee9bb29a0f19756f5167f77c4024854fd58bede7ff8051ac4a2f5acf55443ed29c381e909fd04e5a
-
SSDEEP
3072:KV+VDeAxsOc8WdE7KEgD3fN/FZgTMJNa22IR9Lp3FhMd08Xevd0pG46tBHa/FgFj:WQitu7K3rfnh2IRNxfTv69
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2684 memreduct.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2684 memreduct.exe Token: SeProfSingleProcessPrivilege 2684 memreduct.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe 2684 memreduct.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.