Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 22:37
General
-
Target
6a31c00a5ff67fc65ca27694ad3cbf4b31cc4a6dfd8257a47c4e6c362eef6363.exe
-
Size
216KB
-
MD5
9b835157c613465eceee4ff9778c2bcf
-
SHA1
2112bc35a0ed21df4ba8ed935e5a3a6b31140e5d
-
SHA256
6a31c00a5ff67fc65ca27694ad3cbf4b31cc4a6dfd8257a47c4e6c362eef6363
-
SHA512
8c7d67afcf69ff16c290c8ac153cb68ce1b3f063a2baf7ffa514035b212adb50ca7e846582c19186bb8effc6d037eeb6a6bea2c8c7e241cc244976870ff3c9ee
-
SSDEEP
3072:jEGh0o3l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGFlEeKcAEcGy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a31c00a5ff67fc65ca27694ad3cbf4b31cc4a6dfd8257a47c4e6c362eef6363.exe"C:\Users\Admin\AppData\Local\Temp\6a31c00a5ff67fc65ca27694ad3cbf4b31cc4a6dfd8257a47c4e6c362eef6363.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA7F48B2-5412-453d-ABFF-598ECF0CDBF2}.exeC:\Windows\{FA7F48B2-5412-453d-ABFF-598ECF0CDBF2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53501202-54A1-4542-9C5A-441467F4C436}.exeC:\Windows\{53501202-54A1-4542-9C5A-441467F4C436}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{206C3CD6-8DDE-4e52-A151-EC8FB1217228}.exeC:\Windows\{206C3CD6-8DDE-4e52-A151-EC8FB1217228}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD124140-C25C-434c-93B3-A50315FF03A5}.exeC:\Windows\{CD124140-C25C-434c-93B3-A50315FF03A5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7B733A2-8B18-401f-9BB6-0D240B7DDD79}.exeC:\Windows\{E7B733A2-8B18-401f-9BB6-0D240B7DDD79}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFE35C41-F64C-42b6-BB8C-FDEA291E5373}.exeC:\Windows\{AFE35C41-F64C-42b6-BB8C-FDEA291E5373}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B43E7FD-1E01-4b8c-9E1C-B337D34EA42C}.exeC:\Windows\{5B43E7FD-1E01-4b8c-9E1C-B337D34EA42C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7B7EA19-10D7-4b11-A635-1FF3472D32EE}.exeC:\Windows\{C7B7EA19-10D7-4b11-A635-1FF3472D32EE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FCAEBD02-43AB-42fd-9055-CA4EE98294AD}.exeC:\Windows\{FCAEBD02-43AB-42fd-9055-CA4EE98294AD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CD496C6-563C-481f-9FD7-EF09A5CCACBA}.exeC:\Windows\{3CD496C6-563C-481f-9FD7-EF09A5CCACBA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{434AE304-BB0C-441b-A15B-5C7F7E3A73FE}.exeC:\Windows\{434AE304-BB0C-441b-A15B-5C7F7E3A73FE}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{ACD21663-665A-47c9-B4A0-0AAAD87B031C}.exeC:\Windows\{ACD21663-665A-47c9-B4A0-0AAAD87B031C}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{434AE~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CD49~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCAEB~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7B7E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B43E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFE35~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7B73~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD124~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{206C3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53501~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA7F4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6A31C0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD582b50d461054b2ef1e2aab41c509c3d6
SHA1f3497466a2f949e82712d2d10a791403dfaa0b9c
SHA2562e99893c3c832c1a0d26726d00684b5951562e9f3adda62410adf660653a361b
SHA5125d34caf74e103f5c5b0be71e77c7b1b33e48073a9192ee55334e6f636edc4d981d1b908a6e0e31289d58168cee10722efcfd46dde0b51b792c904e32922e0b83
-
Filesize
216KB
MD568151fdc92dd4e585da733b2a7f205d4
SHA1f5c238d7ed06d4294f0111bb97f93c1b1c9fcff5
SHA2565166c6ac509d6adfd1c0dfd22d217d99e0d937a88059b54187e34ae7d9b5a3b5
SHA512b3aaba52fde58f351ca0c02aff0672166bd5f4223cf2a53419b258bf022b4fe1ddf9820b362517e97d9fa50f137ab9d77dc9f07e6484c71f50576b33b0686ace
-
Filesize
216KB
MD54d133c11da093640bb92e1a9e0270f34
SHA1a3463a91fe9ffacacb2945b0b865a6cac873ab43
SHA256c24948d46946a1aa15410d8c07a38a5e8c6038332739d350a7372a4e63f7cac6
SHA5122134d355de53d1fba27d2b25a111094a7215779a0866ebdbf00a789b7e4fda6374ff18aac5c75dc57a4c63791f785b993cd3e1265f113d26a46e864ba0f12129
-
Filesize
216KB
MD550d81c64f9a049c2045163d9f9d0a61d
SHA1d384afe596d89a9c9dfff4d96f6ea6c6cdc7f70a
SHA25631a647bd2f2a3436cd8d646afb5e1d26f0596c8d3fef48f9942da72b5aafc8da
SHA5123cd6b4c0e45bc55365949d92ac20243232d1cee6df13bce2adb52a181f581b2602d58d0aca11770228982359bbaa5badd411eff75e0e7cb15aa0dccd2663efe6
-
Filesize
216KB
MD5a7a9d5724e6d53a0f2530d4ca4efaa50
SHA1fc09a2761b17795f9a1c26561870309dc51a2b5c
SHA256534a2147fa0a1348249eeaa8abe3951b31f3ba3619aca173acf784d7ec52c2f9
SHA512801c686f023a0001860e27f9307e9faf11ec51e5b41029d15c4886b6c215798f60830f34027e73ee95f97e73bd971cadcd00a252877d42c0343ca4dbe273cd91
-
Filesize
216KB
MD5f4887053bfd19bf578898de1c2c7b9c0
SHA11d5a7809a2e27e5bc345e0d9e5d91546aba428a9
SHA256caea92a61cac78ebd0bd93c5b3ddfc4de8d1a9cb4535fddabc3e3164b73e6689
SHA512be2d952077017bc2861c3d9c47b6de777eb90c0f75dcb96cb878bd8e74cabefcb7eb765139b7a3deceb8887c94f9d4c37a369ce3e7f926092d3f536c30f311eb
-
Filesize
216KB
MD559f05badb38ea32c22e6aca341f0fb62
SHA1eb861faf68258f1cd4f6b423726d86cb7710b8f5
SHA25690a2e02d1dd1faee394c4d0f7825082305a3314f9344851b8f5924bbc1851812
SHA51261546d84c1d778fab0ff9bc3b88a060133e7f3119274b385f557bf4e3b467ffcc993baa1783c05d548e4d764d0bd109d812cd91418b0b6f0ed3ef6b0c6786f2f
-
Filesize
216KB
MD54dbb03f489999920ff1f1bbd974f7332
SHA10ff5c080c8a7cb4bb30cf34f109527560f876a4b
SHA25644a7f79c7e85f0a63d5e05775a5cc8f63a030e4528135838381d79b484049d2e
SHA5127984c28169445a38683e3469afb8aa432f6ada32c9ca623ff78681bfb25146b345865786aa9231ccd46cd304f922fd5be1e92ed77b36c3d5238fae826b150c2a
-
Filesize
216KB
MD5619fb35ab626e5b1f7d3e1a72bba23fc
SHA1e8ed503608a36bbf232830c89e31ce207d8df437
SHA2569bf57026f1452ae690a6051ed6f782384b4fedaec878d0d9421a81c153ac6ed0
SHA512181ad0e7686232e717157fbaaed74bc4659b72d694e0f606a8aa763577d0516f5d2243e32b4d374bc913d1944d53e63269398cd3cff70520eb310d0c7a7d5c66
-
Filesize
216KB
MD511330117a63067f71fb81cf8c5b70908
SHA1b4e673d0782e8508dded3b7025e9e9e4089c4ca1
SHA256f6fbbf0a7084588ecef2cbb9eb02c177d057dcfa74164fb2767af369fb4db61c
SHA5127eb72a7b619fea5f77cb8f7455fa602dad9c584b7024e73270b9ccce5028e3c895de8c85de4fd22abdd542b5f87e685f1885dfcc17591e3f2c4912b399be4cea
-
Filesize
216KB
MD58b34c54fa91617dc2f97a9cf43bd1c07
SHA10288013e174cb17f82a6a92ec16cd83489042e40
SHA256a543150bacaac6b39433f502668d4422d375f02d07fba7a4f930b0ef493c2c08
SHA5123226b50dacdedbdfdbdc20a5a5fe916a6dc37f5065c5578708762d70912cc3b0ad30f724c80710290ef168b8d26d472358b6ef75ed1c362edec5374d1e56310a
-
Filesize
216KB
MD5c950c03a86b3f98dbb19de578e36a969
SHA186d25d3a2cea33b9e0aec525c7b759194cb9cdf5
SHA2560a5e8a615fea8404416e596d812e0bd775de0be7bdc3065c2bf265cb49f15259
SHA512f0fb9143c672ac4e8bfbe27df73e0464d0fa248545d36898d373f9e30342e858e7361ddd9633549a721140802004e01019bb94eab91f19a71c13d88e1a5831f4