Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 12:48

General

  • Target

    Startup Delayer.exe

  • Size

    3.9MB

  • MD5

    909e3113d00adfebf817c7c5d971feb6

  • SHA1

    fad10e5fa809f7419ce3d164809ebccc97380968

  • SHA256

    5e134a61372ddfe554ad53e01858023941c890eb2f9828efe9d944f49d99cbb8

  • SHA512

    b35551bf6e3b6e63c5b2b5cb968cec3a8188b96bf930b77d7bb6c9b3cea338c1a1a3972b8afe1423f3c04d2082c3a1024309c532732317af3dae890e59e21da3

  • SSDEEP

    98304:WFputdH6WVeLWV4lfQbj4fqYJj3XdvtoaMzDwxymBGFp4NHvOmNUC2V4nttMkf+K:maH6WVeLWV4lfQbj4fqYJj3XdvtoaMzy

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Startup Delayer.exe
    "C:\Users\Admin\AppData\Local\Temp\Startup Delayer.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2948-0-0x00007FFB94875000-0x00007FFB94876000-memory.dmp

    Filesize

    4KB

  • memory/2948-1-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-2-0x000000001BE30000-0x000000001C2FE000-memory.dmp

    Filesize

    4.8MB

  • memory/2948-3-0x000000001C380000-0x000000001C3A0000-memory.dmp

    Filesize

    128KB

  • memory/2948-4-0x000000001C440000-0x000000001C4DC000-memory.dmp

    Filesize

    624KB

  • memory/2948-5-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-6-0x000000001C650000-0x000000001C6D4000-memory.dmp

    Filesize

    528KB

  • memory/2948-7-0x000000001CC70000-0x000000001CEF6000-memory.dmp

    Filesize

    2.5MB

  • memory/2948-8-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-9-0x000000001CF90000-0x000000001CFF2000-memory.dmp

    Filesize

    392KB

  • memory/2948-11-0x000000001D400000-0x000000001D70E000-memory.dmp

    Filesize

    3.1MB

  • memory/2948-10-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-12-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-13-0x0000000001310000-0x0000000001318000-memory.dmp

    Filesize

    32KB

  • memory/2948-14-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-15-0x0000000020530000-0x0000000020886000-memory.dmp

    Filesize

    3.3MB

  • memory/2948-18-0x0000000020890000-0x0000000020960000-memory.dmp

    Filesize

    832KB

  • memory/2948-19-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-20-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-21-0x00007FFB94875000-0x00007FFB94876000-memory.dmp

    Filesize

    4KB

  • memory/2948-22-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-23-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-24-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-25-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-26-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-27-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-28-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-38-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-39-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-40-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-41-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-42-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-43-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-44-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-45-0x00007FFB945C0000-0x00007FFB94F61000-memory.dmp

    Filesize

    9.6MB

  • memory/2948-46-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-47-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-48-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-49-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-50-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-51-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-52-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-53-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-54-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-55-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-56-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-57-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB

  • memory/2948-58-0x0000000029240000-0x000000002A8B7000-memory.dmp

    Filesize

    22.5MB