Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/07/2024, 06:52
240706-hnee6azbjk 606/07/2024, 06:50
240706-hl8afssarg 606/07/2024, 06:43
240706-hgxm6ayhlq 6Analysis
-
max time kernel
236s -
max time network
230s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
06/07/2024, 06:43
Errors
General
-
Target
RCCService.exe
-
Size
5.2MB
-
MD5
c4641e109dbc33cf7d30ff17548b6dc0
-
SHA1
3c21a30dbc80e8fdceb413a41ceb2612ab134ddc
-
SHA256
28a91c954c66714cda48b2ca4ce52459cdb191755f6825e02b00e430aaef67b9
-
SHA512
b1ce2dc42829c379a0b50bcd69231b26996484cf8184351db023f759a48e952c531b427249cbedeb4a18cd9ffaa6504e8da2752b9f43fefd42028753cd6380ec
-
SSDEEP
98304:oQ9rjjcAka3x9vgdHHSmnFFSaxhsHHF/81eNApeap+/SX/b1/GmOPL:PaAz3x9OjnFFSaxgHedtp+6xQPL
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 10 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RCCService.exe"C:\Users\Admin\AppData\Local\Temp\RCCService.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5ef020b32228484ecd76ef0b745fd609a
SHA1fa9223657f99a51700629607b2f6c5bb1f3bfcb9
SHA256592e90083df2192e2b94f57b0fc552f8870a862f78d546a01f96b2a8c0f838d7
SHA5126bbba17be5998d6359b1ec1a2642857e85e601bf241f6a073679f5e8391fd960d5e56cd60e0acf4b109b5d7f1c42e8dfd20e6160f40c2a2f4c3f9eafc6356045
-
Filesize
10KB
MD5ca9707a81b4b5d527d0819546cfba565
SHA1828bfd131cbabe331de0780f79e9bf2d76116665
SHA256f4f31d127c1bed29b75ac8d17e2325115c7d6be40d0765f8b4fff44894faf6d8
SHA512ed443f1e85889de836c6a8acd69d7ec920a42223ac1787e4e1823ddfcd5f9465f9cd417b4b649a961427c8ef75327414cdab0427d866cb429f9095859742b73a
-
Filesize
8KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
680KB
-
Filesize
10.8MB
-
Filesize
10.8MB