Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
19s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 15:26
General
-
Target
Kopx_Perm.exe
-
Size
5.5MB
-
MD5
cd04c6b2aa6c3db3afe23710f77744ce
-
SHA1
fa9a6c7aa03369b78d7495828e1e8c2f1f6d2017
-
SHA256
c1bdfe41a13815c0ecbe8ccf4000704ccb245bbfc47ef2f2123ecd873a7257c5
-
SHA512
9ea38d6c146eb3487dd36234211fae80936ea6135d402ce032f50429c0a0fc3b48f0f627f0fc95fe5c3612b8d84bf4bfe8def00fb878d15bdbb738cba7507eda
-
SSDEEP
49152:MWFnhVOoUFnhVSr9JkzvkjXa+FnhVSr9JkzvkjXabsBFnhVKTTFBySg6etzcwp86:MfyrkzgXyrkzgX9orG8farR1
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 21 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kopx_Perm.exe"C:\Users\Admin\AppData\Local\Temp\Kopx_Perm.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
500KB
-
Filesize
500KB