Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
09/07/2024, 03:19
General
-
Target
a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe
-
Size
135KB
-
MD5
a796ef28a106994c1a1c3a7863be7104
-
SHA1
6da415bb8f1946a97cc5c0622673f320d5d39404
-
SHA256
a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2
-
SHA512
bb6ef2107f18847b2f7092499bb1d47ddc0fef3b886069d24bf735e58a43c64825855cb1582fbb99124f7802a5267aeb620e46374d00fa7390c48a89fde5bcab
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVuWLY:UVqoCl/YgjxEufVU0TbTyDDalAWLY
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe"C:\Users\Admin\AppData\Local\Temp\a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD52f0247a0155da063c1fade1fc8aa7253
SHA121a633f2cfe9a278738624c863fac01f39f6df4a
SHA256e832e99d67da6553c0952701008c45afa98c5cac06913425367dbeba44509ae7
SHA512272fb30a60cfea587e671ce09fa33d1758204459ae120787c4513a5ae7bcf880d256c890056e791978b13e5c23a618852271c793c7458ce2e1f5e2d3c4f02b9a
-
Filesize
135KB
MD5393abc9af49220877576acc3a1324353
SHA1c3b7d39122facc1a9271d8f029519328f0342ab5
SHA25635b70350947e1c52ee7d6435ae49a2452cfd2ba28da6d4e953fbfb57b77b098e
SHA512edd102675c3457785abe52f54c003055c7750fde48332c72a68006f2d3880a7a3d75a57c7537f192369c1d9b220f429719478910b954b940687e2eb0425c5f0f
-
Filesize
135KB
MD5facbd21981ad64538a6fb1527a70d264
SHA17fb6968e449e7850ccd9062d64f4c7303573fc25
SHA25600d9aae29846a7e9b80d58004dffaec521a8cad00ac24b62092c14fb1a5778d9
SHA5121f7e42f1ec491e9a2a73c45e0408f2d154c01198c10872d3832857e6853879614883a58a393fd5e6175ccabfa941993965acd45bfacaf8522b90c75fdacf7779
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB