Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08/07/2024, 14:01
General
-
Target
17510883e112fb817eb60eda9bf9cd40N.exe
-
Size
484KB
-
MD5
17510883e112fb817eb60eda9bf9cd40
-
SHA1
d2cb43908af542534dd5722e882a29867908bbf0
-
SHA256
97f6000c5473c9a9c7499fc09faa85978c138326551b8b4bb512d3ea7241fda4
-
SHA512
01a441ee2f8ce2653aaf98dae32cb7c8edc46f035591aef0795917fe9fdf2b01a71bcafad54d96e060685f97aba4caecb7af16c346856dc26e1943be3212002e
-
SSDEEP
12288:kLPkCDt1EG2XVekhdeTi0TrAFQMTB6WP5sFVm2tV:kLPkQ1bqA603AOaB6WOVp
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\17510883e112fb817eb60eda9bf9cd40N.exe"C:\Users\Admin\AppData\Local\Temp\17510883e112fb817eb60eda9bf9cd40N.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RunLHost\edpnuirt.exe"C:\Users\Admin\AppData\Roaming\RunLHost"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~B508.tmp3424 496136 1004 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 6203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\ddodshta.exeC:\Windows\SysWOW64\ddodshta.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3940 -ip 39401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
484KB
MD52e6026e7ec826fed4667e455b3e54ae8
SHA1da9688d63f22c03f9264f3b22e5e577529619546
SHA2566f061c9c648f982597ebab0e0a87e166a6df1758b558cd6826d87c526e788183
SHA512c31e26a91404a5154e0a72e12ef35ce81b96addc16c267ca4a958971c6824e6cf0ead5c4b13accecf186f4f9eb38e8e313b4b46c19c640ce7397df916146632a
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
52KB
-
Filesize
524KB
-
Filesize
524KB