Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/08/2024, 11:37

General

  • Target

    Вас Заметили.png

  • Size

    39KB

  • MD5

    2a801dbd22a79636b9f34635c79ccb8f

  • SHA1

    5a40990c64ced4330cf06af7b2e2a4a8ccdd3cba

  • SHA256

    96487209d8bd5d5c8b92b2cef8d8ac27211a422717c2e819e68a3eec5b324ff3

  • SHA512

    bee135856c35c4b1b70e4c56280d7932f264bf887d3860cfc6cd7ad7f46a8f5a43ca6318a0bfa67e4b08192e10a538e747df03c13b1d3aaad5bfb7239aa5c7ef

  • SSDEEP

    768:sQ+tslYkI0C+5oZg2+gYhSonb3vOBVJhNMsvr/DuoIZ+4//6o1rQZ4ew/ifJ2:sQ+YBZO+nSa/OJc7Z3ioBrb/T

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Вас Заметили.png"
    1⤵
      PID:1448
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c0ukfbeq.4xo.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • memory/4988-2-0x00007FFE9BC73000-0x00007FFE9BC74000-memory.dmp

      Filesize

      4KB

    • memory/4988-7-0x000001E07C2D0000-0x000001E07C2F2000-memory.dmp

      Filesize

      136KB

    • memory/4988-8-0x00007FFE9BC70000-0x00007FFE9C65C000-memory.dmp

      Filesize

      9.9MB

    • memory/4988-36-0x00007FFE9BC70000-0x00007FFE9C65C000-memory.dmp

      Filesize

      9.9MB

    • memory/4988-35-0x000001E07C6E0000-0x000001E07C71C000-memory.dmp

      Filesize

      240KB

    • memory/4988-47-0x000001E07CC30000-0x000001E07CCA6000-memory.dmp

      Filesize

      472KB

    • memory/4988-52-0x00007FFE9BC73000-0x00007FFE9BC74000-memory.dmp

      Filesize

      4KB

    • memory/4988-53-0x00007FFE9BC70000-0x00007FFE9C65C000-memory.dmp

      Filesize

      9.9MB