Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    4s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/08/2024, 18:31

General

  • Target

    build-high.exe

  • Size

    30.1MB

  • MD5

    d803500870dbbb7d4972f622eb6edb00

  • SHA1

    b3ee07e5eb3d157d515f41158cd38a20a615685f

  • SHA256

    c93305d6471bed91bf4a0f4861197f4a628739fe1deef732eddb406fdee0a2c1

  • SHA512

    7cf92db95ba8ccad105db073c48f994807dcc2680aa10bd392d6b01a418415c6050e1504bce8bea44665e3f1abff150b56aa698265ebca686643fd49e014115e

  • SSDEEP

    393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgu96l+ZArYsFRlC:R3on1HvSzxAMNuFZArYsK

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 55 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build-high.exe
    "C:\Users\Admin\AppData\Local\Temp\build-high.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "explorer ."
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1192
      • C:\Windows\explorer.exe
        explorer .
        3⤵
          PID:3212
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "open youtube.com"
        2⤵
          PID:4164
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1320
        • C:\Users\Admin\AppData\Local\Temp\build-high.exe
          "C:\Users\Admin\AppData\Local\Temp\build-high.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "explorer ."
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4916
            • C:\Windows\explorer.exe
              explorer .
              4⤵
                PID:2160
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "open youtube.com"
              3⤵
                PID:3392
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:5032
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:1688

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads