Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 13:50
Static task
static1
Behavioral task
behavioral1
Sample
c43fa4da450d4842afe24a8ac4ab2ae0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c43fa4da450d4842afe24a8ac4ab2ae0N.exe
Resource
win10v2004-20240709-en
General
-
Target
c43fa4da450d4842afe24a8ac4ab2ae0N.exe
-
Size
162KB
-
MD5
c43fa4da450d4842afe24a8ac4ab2ae0
-
SHA1
0b9fce1fd1dd245569d289aa456bffae1877fd33
-
SHA256
819bb81f97d27f729656e8fd0be64a8aaab2a7cdeaedb59eed5ea52a48c16be6
-
SHA512
cd8523b78272498e1b71f24ec9d5bc92f9b6bf4c6687c90b49e57f57977678d87940d480b6dec670054e695f06028bc747b2f04f0d4f855219a6c28213e30a06
-
SSDEEP
3072:51oVtum4WHvjVGr8kgB9s8p+uRcKVHM0lma3UroAew5ak23n2MgN8Dljt:5mtmCjkU9Wu6uFYwsegak22TQlJ
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Executes dropped EXE 1 IoCs
pid Process 3788 mkgxrai.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\mkgxrai.exe c43fa4da450d4842afe24a8ac4ab2ae0N.exe File created C:\PROGRA~3\Mozilla\nvxyjpn.dll mkgxrai.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c43fa4da450d4842afe24a8ac4ab2ae0N.exe"C:\Users\Admin\AppData\Local\Temp\c43fa4da450d4842afe24a8ac4ab2ae0N.exe"1⤵
- Drops file in Program Files directory
PID:740
-
C:\PROGRA~3\Mozilla\mkgxrai.exeC:\PROGRA~3\Mozilla\mkgxrai.exe -ndbcamk1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5b0c69ac9af5c628f3889b7cda5982874
SHA141fa05828aeda3f41d7790218e1d5e2c8df14583
SHA2564c7c8eb8031b2dbe460eb7c2a01fc2d56982a467efad0b0d6292a1101ef70879
SHA512557053b7287ae827242055633b6c9b10e2dbbffc5ca01bf749448563c018c21c9451f7b9ab53e635e0963c4ce76cc95fa2b90dbff672de984b6141973fb14a63