Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 01:18
General
-
Target
52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79.exe
-
Size
3.2MB
-
MD5
56969d3e42eb60bc95c97d51377f0de8
-
SHA1
6d9844be2bbcc86f9c07d8d40c774ce642502c4f
-
SHA256
52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79
-
SHA512
ad81e190b09b211a63ea9917934909576ee43c8f97f1b98020c0add770d57214a7e4ae11bc9601f42fced0124072a148d68dddd175995e1a8126de03d59112a0
-
SSDEEP
98304:DHK+r2k6cc9zrObZKEM8O8PluQhfgN5/7FBR:DHKRk8CsEEOfyd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79.exe"C:\Users\Admin\AppData\Local\Temp\52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3TLHMGgyHB.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Default User\csrss.exe"C:\Users\Default User\csrss.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207B
MD593f6a9878ba0c6834b0a83fef82da268
SHA116ad8722150a69c3a58298a26d04f53cf31ea461
SHA2562c49e4f62a43ee60d116caaefdc97d6e924fab93254ac630341419c9f8dac6fc
SHA512835c5824195085d8e392757d4c0ca6e56bdc23058cb05c2de10c212b8e4aebc1425aa51b48f8195454b4e84fb45fe4cff81a972bc29accdc27670c25100dbbfd
-
Filesize
3.2MB
MD556969d3e42eb60bc95c97d51377f0de8
SHA16d9844be2bbcc86f9c07d8d40c774ce642502c4f
SHA25652f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79
SHA512ad81e190b09b211a63ea9917934909576ee43c8f97f1b98020c0add770d57214a7e4ae11bc9601f42fced0124072a148d68dddd175995e1a8126de03d59112a0
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
10.8MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
152KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
96KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
360KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
312KB
-
Filesize
10.8MB