Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
109s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe
Resource
win10v2004-20240802-en
General
-
Target
f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe
-
Size
1.4MB
-
MD5
4f14ef9740420824d3b6b593b23faae8
-
SHA1
5969cf73425ec6f9fcd3ee77082907a94e1c288d
-
SHA256
f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f
-
SHA512
a0ddeda6bf7255aea8c7eab7f09db24e0e8f6db6f77c80bea5dc22808accf5ffe4fda7d7497fd5a87fb69daefe2ef0eb18a7cd1b15467672ad1cc2c5daa5d5f4
-
SSDEEP
24576:YzJrJmbDIWK8eRB7/imbdaBolL1Sui5f42ToUgyl/oq6SFVwRGxtuWCUOqHMiTTJ:YzxJmohdtbGold8ZkIo+FqUZCvqHzsNg
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1932 f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe Token: SeIncreaseQuotaPrivilege 1932 f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe Token: SeProfSingleProcessPrivilege 1932 f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1932 f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1932 f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe"C:\Users\Admin\AppData\Local\Temp\f3a3b04c8352d3109cbd5535653e3e5e3f40b7f016e9b2850d9eddc77d8bc75f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78B
MD52f1979afffe2f52806bf00969fc63883
SHA13a05318162037495824267106467e9b9a0253610
SHA2565968e3fe951fbc9d4674912d567e5e11bf3556194b325f8933b582cbdc27dfda
SHA512211a3be18505babc3e5f891f61826a98db08832b3b73184730e4fd4a9ed614529114b7aa8481bd59bd58e2c265c9b03aa19e7b1eb59107683c60474c53c076e2