Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 02:31

General

  • Target

    WinTools.net Ultimate/WinToolsNet.exe

  • Size

    2.8MB

  • MD5

    c0218d32754ecc51c44f183cf06982b4

  • SHA1

    1adb184201f33ef1c5b6c4a0d5fe2b2068cc3918

  • SHA256

    b10e893615c5fe410d14d3f282d85cff73f07f0828595b68ace9dcf4d32933ac

  • SHA512

    cd53481bc95bfd8d3bbac15aca988bb7a5ed463a1dd838a1187f62f19c5dcad47a1180d0db4b80eddfd083cc695d9ada32b939f8f7ac78d94fbe6815853f203c

  • SSDEEP

    49152:E5mvPhVCPgAxOY1ntFh8U+HWbfiMpa3O/lcOU7m6Ccq:mmh5AIY1nt38n2TiMpwOU7rq

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\WinToolsNet.exe
    "C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\WinToolsNet.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\WinToolsNet.ini

    Filesize

    10KB

    MD5

    e64e74ff5fd9c606fbb5b3bf790ccdcb

    SHA1

    928a2f0f54291d5810b901f07e940034186a4361

    SHA256

    60331af36706cf1db125cf0904e3f8b32a76ce13199a68c8814a08dc6fe34880

    SHA512

    93f7fc551fe0f75d3767a86f1c28f300b097649168ff2fcdc4e6f9866b7099b6635e193e9fc62cd17b4d1604d50e84f52f90bc711c16f43deb10df8114787004

  • memory/1896-21-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

    Filesize

    4KB

  • memory/1896-9-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/1896-8-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

    Filesize

    4KB

  • memory/1896-7-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/1896-6-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

    Filesize

    4KB

  • memory/1896-5-0x0000000000E40000-0x0000000000E41000-memory.dmp

    Filesize

    4KB

  • memory/1896-4-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

    Filesize

    4KB

  • memory/1896-3-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

    Filesize

    4KB

  • memory/1896-2-0x0000000002A60000-0x0000000002A61000-memory.dmp

    Filesize

    4KB

  • memory/1896-11-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

    Filesize

    4KB

  • memory/1896-31-0x0000000002B10000-0x0000000002B11000-memory.dmp

    Filesize

    4KB

  • memory/1896-32-0x0000000000E50000-0x0000000000EB0000-memory.dmp

    Filesize

    384KB

  • memory/1896-30-0x0000000002B20000-0x0000000002B21000-memory.dmp

    Filesize

    4KB

  • memory/1896-29-0x0000000003A40000-0x0000000003A41000-memory.dmp

    Filesize

    4KB

  • memory/1896-28-0x0000000002C10000-0x0000000002C11000-memory.dmp

    Filesize

    4KB

  • memory/1896-27-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

    Filesize

    4KB

  • memory/1896-26-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/1896-25-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

    Filesize

    4KB

  • memory/1896-24-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

    Filesize

    4KB

  • memory/1896-23-0x0000000003A40000-0x0000000003A41000-memory.dmp

    Filesize

    4KB

  • memory/1896-20-0x0000000002B30000-0x0000000002B31000-memory.dmp

    Filesize

    4KB

  • memory/1896-22-0x0000000002B80000-0x0000000002B81000-memory.dmp

    Filesize

    4KB

  • memory/1896-0-0x0000000000400000-0x0000000000C5B000-memory.dmp

    Filesize

    8.4MB

  • memory/1896-19-0x0000000002B70000-0x0000000002B71000-memory.dmp

    Filesize

    4KB

  • memory/1896-18-0x0000000002B00000-0x0000000002B01000-memory.dmp

    Filesize

    4KB

  • memory/1896-17-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/1896-16-0x0000000003A40000-0x0000000003A41000-memory.dmp

    Filesize

    4KB

  • memory/1896-15-0x0000000003A40000-0x0000000003A41000-memory.dmp

    Filesize

    4KB

  • memory/1896-14-0x0000000003A40000-0x0000000003A41000-memory.dmp

    Filesize

    4KB

  • memory/1896-13-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/1896-12-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/1896-10-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/1896-37-0x0000000000400000-0x0000000000C5B000-memory.dmp

    Filesize

    8.4MB

  • memory/1896-45-0x0000000003A70000-0x0000000003A71000-memory.dmp

    Filesize

    4KB

  • memory/1896-44-0x0000000003A80000-0x0000000003A81000-memory.dmp

    Filesize

    4KB

  • memory/1896-43-0x0000000003A60000-0x0000000003A61000-memory.dmp

    Filesize

    4KB

  • memory/1896-42-0x0000000000E30000-0x0000000000E31000-memory.dmp

    Filesize

    4KB

  • memory/1896-41-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

    Filesize

    4KB

  • memory/1896-40-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/1896-39-0x0000000003A90000-0x0000000003A91000-memory.dmp

    Filesize

    4KB

  • memory/1896-38-0x0000000003A40000-0x0000000003A49000-memory.dmp

    Filesize

    36KB

  • memory/1896-1-0x0000000000E50000-0x0000000000EB0000-memory.dmp

    Filesize

    384KB

  • memory/1896-48-0x0000000003A40000-0x0000000003A41000-memory.dmp

    Filesize

    4KB

  • memory/1896-49-0x0000000000400000-0x0000000000C5B000-memory.dmp

    Filesize

    8.4MB