Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 02:23
General
-
Target
c937044b5ca8ff27ffd0c7f2531df6bb4583416a21d81809e14219808b0e9035.exe
-
Size
90KB
-
MD5
a19f1807122963e2331337a66e55cd86
-
SHA1
bde12bcb403ed6d409efa6a62f6dd0e2415498f2
-
SHA256
c937044b5ca8ff27ffd0c7f2531df6bb4583416a21d81809e14219808b0e9035
-
SHA512
7807e3a0f50e0b6e81d9bf80d51fcb8866f399329c3d793749e17e16a608adeb6e232f661c12789dbc6b9eb6a01f71e8b8f5e70b4485fb8ceffdc48b1d4d7d02
-
SSDEEP
768:Qvw9816vhKQLro/Z4/wQRNrfrunMxVFA3b7glws:YEGh0o/Zl2unMxVS3Hgz
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c937044b5ca8ff27ffd0c7f2531df6bb4583416a21d81809e14219808b0e9035.exe"C:\Users\Admin\AppData\Local\Temp\c937044b5ca8ff27ffd0c7f2531df6bb4583416a21d81809e14219808b0e9035.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{55601EAD-9B03-45ed-825A-24E991482B8D}.exeC:\Windows\{55601EAD-9B03-45ed-825A-24E991482B8D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DA9261E-6C25-41bf-BB92-07ADEDA6BC1C}.exeC:\Windows\{1DA9261E-6C25-41bf-BB92-07ADEDA6BC1C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0972475-1AE3-4090-9450-9D7FD905B697}.exeC:\Windows\{E0972475-1AE3-4090-9450-9D7FD905B697}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2D055B67-16FD-4d80-8F17-20E3AC9D827E}.exeC:\Windows\{2D055B67-16FD-4d80-8F17-20E3AC9D827E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7096461-725D-499d-82D8-161BEE417A5C}.exeC:\Windows\{A7096461-725D-499d-82D8-161BEE417A5C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76AFA0DE-DFC9-4817-AC16-56C94CEDA113}.exeC:\Windows\{76AFA0DE-DFC9-4817-AC16-56C94CEDA113}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA60BA99-C6EC-44a8-9457-31A0CFC994AB}.exeC:\Windows\{CA60BA99-C6EC-44a8-9457-31A0CFC994AB}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{800C5924-4437-4ae3-9F86-99AF8775D463}.exeC:\Windows\{800C5924-4437-4ae3-9F86-99AF8775D463}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69BD4F53-B14C-4ca1-8B68-49F5C9D41058}.exeC:\Windows\{69BD4F53-B14C-4ca1-8B68-49F5C9D41058}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAF5AF5A-ED1D-4444-95D4-0E4470A8CE45}.exeC:\Windows\{AAF5AF5A-ED1D-4444-95D4-0E4470A8CE45}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B3B8ACE-743C-4efd-A379-543729F4F3C4}.exeC:\Windows\{8B3B8ACE-743C-4efd-A379-543729F4F3C4}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{04F48D4F-7AB6-4db9-9A38-E97B18D402E6}.exeC:\Windows\{04F48D4F-7AB6-4db9-9A38-E97B18D402E6}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B3B8~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAF5A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69BD4~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{800C5~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA60B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76AFA~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7096~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2D055~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0972~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DA92~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55601~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C93704~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD57c0690aa2d23b5151536ff3da5f6b7e2
SHA1eed32553556ebaa1afe07f1d0506df1414a0a923
SHA256b73e80d81e625064a9124c3d9289b742faac84f0f42faba659bd308a2b432f29
SHA51219484feb7cd793639f29988d3b8f8311d7e2e4349c9e5ac05668591f3dc8fdd10e3160561f864fa0748a1b0508e5d125ffa18d76db8740135778c2c438a08d78
-
Filesize
90KB
MD571a100176d16c13a13d94cf5b51771ec
SHA1775c468e913008fce6e41cdb072007eee97752bf
SHA2565e315d3a6bdc9a413f450a2225fab9ddd0f9d937fac5c77b43811fb3bacf2b69
SHA5128e6b4be8532bb7878a676524086843f01d06548dda0d162c885f6c1057857e38240d6acf9ecdfe9541fcb9e778e310c814edfc3f0fb518275b13e6844c226a9d
-
Filesize
90KB
MD509e13ae54970e1fc89ee76ff8c7f274b
SHA18bca9b12c81303af26f78cbf9656d54245cf891f
SHA25641ebb23b74c883e18630ea888413cca84601f891961cadf67ac511e0eb4e844f
SHA5120d0417c32c0828e9c2c62e707da0378d4618489da4d28418892ac423f8bb449474b434aa486268c9c63b6e9643af8aaced4657327e35c38ffa61bb137e8fc732
-
Filesize
90KB
MD5757967a28aefad65191d969678839584
SHA1eccee8dddecc6b1bf3ae9506414d0cb424a03a35
SHA256a937c2d27cf549d9dec62deed4ae61f6935c939d46919f3002e68adcf2dc7197
SHA512791bc045ce5cc1bae414f6bf4debd94537f4ceb609845d8c5a609195d55e23a7cea39fa3ecf1403041558c0ac62dd1f7f16f16e0a8b7aa3479cc1ed50bc1baa1
-
Filesize
90KB
MD5f82be05ffec86a5563e6faf4c98b2ee3
SHA13a03a394fb96b81644028417782a785919e89455
SHA256111a423d75cbaaf2fa26d1338daccdf4db9dabfb9803bb0d975e4ddea1a5388b
SHA5123bad5f8b22e86448b49dc1cf659908041535015baaa1682285c69d18bd9fa1f511773f9406dddb59d940fd452caa33e0d9f5eb832c71187ecbcfa96d263fef0d
-
Filesize
90KB
MD5653ef2487553c4d0fc9bca16c6934569
SHA132b059b39439b5d6b8ff4e0b7d56429a82c21a8a
SHA256de74d12657a942e2f9bf649ff96b522669a2dca928aa4923aab68a29fba89e4a
SHA51216f65e587e2fad0347e740ba41c066e3de746cc487eaeffdea0545e54e7c4aa6c8f333fa2f3e8a8cc28d757abbabf8c57f3a75e7c982a2cd46815c6644fb85db
-
Filesize
90KB
MD5ae92b36bab2e76a82be3e083e8361bbf
SHA1ae23258cb54ca2785bea14d658e0797afe5db90a
SHA256919cfb77e288eecc0d47420221fadd6682d71749d6fefc821984728f1de92cc2
SHA51255633e7e5ae4eafd595426dabecc42f57c9e360e3fa936f06e830ac4e0e25354a5b78b894a747bd64bf772ff33970cf454dfaba566f2fe9cac8f39d6faf0ddf0
-
Filesize
90KB
MD595247ccac2cd37890ca07962449ebba3
SHA1eacc2c4a9925bc148109ca1f3f7ef4065f79183f
SHA2566fc59d744dfda5a3c9ddc0971b392e35a80ca5f27e545320f43af77553c4ddc5
SHA51293c4cc8d1efd3824897ba2d290aca9a487bd370d86a92b20c772a8d98f68b6ab780968e107af1db78ef721d0e6bb240b8cb5b8fa9bea87451a431d45a1f7c11f
-
Filesize
90KB
MD586eb38b63da558a55b192cf06cda126b
SHA1c6cc7ec2091ad01585bc48500d881fcf9b787d96
SHA2561cbf241bade9980122d15547dac32b98fda09b0f7ad32c096dec8e42648dfa83
SHA512558548f40e62bcd1f19ac69d5b8d6f5106efe643b876a64d2a7a1dfe00139e9e49057eaf97742a97e0d7f7e37049f9da9b1619fe58a02b978e45196f6b2f8f39
-
Filesize
90KB
MD5f8d06846ceafc307619520bb6a90115e
SHA116e89fe638bf7e71a10354b9e00bf787ceeef79b
SHA256303c29a5c3ede880d3b37a910e9dfb21159e6a4a4e2a9a5ee32e46b7df453b3c
SHA5122cba7afb1db1ead5691d1fe107faa66a94cda0593f454bbd1e757ff28e423709a6d22730cf6d87d9e441190ebd43a6fc89bff0abbb94a6b0f07ad0711c4c2271
-
Filesize
90KB
MD5a3dbf61576b0963975142869d2374a27
SHA13598a7b2006cdf83af29893ea8f9f7399328721c
SHA256298a011bd91fdf2dc40729df43b5733619807f006c441855d61e8fcaac1add41
SHA512f9f1750e6b9b530a32f4c9ef3d802e00d278f8f002c2589f32060bff4a65a9c590db758f45f91fdd0c47b39dea915efb8b9ff1c8c7b18571ba9da79a28d6b206
-
Filesize
90KB
MD5c421848059437320366a7211617a193b
SHA1e7e882bad434374dc64ff453b91d7025b19792e4
SHA256dbd050cbdfb30ac429baf664620259401376b21948a6ab8c9a58401cbf5088e2
SHA51283be0857fdc0ea3d160b398fd84bed497b3e986489eae6be845e3cfb8d48842cc4f9ff54763c9dc4ce5a106915a2ba00cf1a41e887f2f7e07409e64e544c5782