Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 14:57

General

  • Target

    c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe

  • Size

    545KB

  • MD5

    881da0522cf92cdd44a9778bfd3d5569

  • SHA1

    7b3d65ac8930b53d137a276f28b3e7100f7206a2

  • SHA256

    c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763

  • SHA512

    1a831ba9074e5562967f61cdee76e7cfd19ebe39d869e6d1d88cfab8335ca258118c695c0447856b7d31d3cff6c582dd00536273d841368e39cde0263b680727

  • SSDEEP

    6144:2muIkxKEZsao1MggyosezYLKEbBOXkPElXxBnYcQMBKist1bGl3tYDG:TuIk03Vosn608lXxhK2Rt/

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe
    "C:\Users\Admin\AppData\Local\Temp\c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2448
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1620

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2448-0-0x00007FFDE98C3000-0x00007FFDE98C5000-memory.dmp

      Filesize

      8KB

    • memory/2448-1-0x0000000000630000-0x00000000006BE000-memory.dmp

      Filesize

      568KB

    • memory/2448-2-0x00007FFDE98C0000-0x00007FFDEA381000-memory.dmp

      Filesize

      10.8MB

    • memory/2448-3-0x000000001C0A0000-0x000000001C116000-memory.dmp

      Filesize

      472KB

    • memory/2448-4-0x0000000002780000-0x000000000278C000-memory.dmp

      Filesize

      48KB

    • memory/2448-5-0x0000000002800000-0x000000000281E000-memory.dmp

      Filesize

      120KB

    • memory/2448-6-0x00007FFDE98C3000-0x00007FFDE98C5000-memory.dmp

      Filesize

      8KB

    • memory/2448-7-0x00007FFDE98C0000-0x00007FFDEA381000-memory.dmp

      Filesize

      10.8MB

    • memory/2448-9-0x0000000000E00000-0x0000000000E0C000-memory.dmp

      Filesize

      48KB

    • memory/2448-10-0x00007FFDE98C0000-0x00007FFDEA381000-memory.dmp

      Filesize

      10.8MB