Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 23:12

General

  • Target

    Vakitharcama.exe

  • Size

    206KB

  • MD5

    9bd34fe539a048d0e2bc0e3ad7c4eaeb

  • SHA1

    ee24f606db053798d6a17f89302b9dfeabc1b06f

  • SHA256

    917050f1ec1f187d7df789d5aa774ac9f6472b45ac50a8a99fb0fc977627f791

  • SHA512

    fac2f39a9408584bb23301f11eec845cb2aad343ce8dd24fcb0e7a8ca4d191a32b20374af9699aa99800e0fb2caaee743e022187b44bb8e01e2000833d81d7e6

  • SSDEEP

    6144:oJSTrJJQJohgBZl8pRcsdow0uiSalT0ECMg:oJoJ9cl8pRGw0uiSST0ECMg

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vakitharcama.exe
    "C:\Users\Admin\AppData\Local\Temp\Vakitharcama.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1852
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3928,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
    1⤵
      PID:3264

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1852-0-0x00007FFAC7775000-0x00007FFAC7776000-memory.dmp

      Filesize

      4KB

    • memory/1852-1-0x000000001AF90000-0x000000001B036000-memory.dmp

      Filesize

      664KB

    • memory/1852-3-0x000000001B510000-0x000000001B9DE000-memory.dmp

      Filesize

      4.8MB

    • memory/1852-2-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB

    • memory/1852-4-0x000000001BB30000-0x000000001BBCC000-memory.dmp

      Filesize

      624KB

    • memory/1852-5-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB

    • memory/1852-6-0x00000000009E0000-0x00000000009E8000-memory.dmp

      Filesize

      32KB

    • memory/1852-7-0x000000001BC90000-0x000000001BCDC000-memory.dmp

      Filesize

      304KB

    • memory/1852-8-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB

    • memory/1852-9-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB

    • memory/1852-10-0x00007FFAC7775000-0x00007FFAC7776000-memory.dmp

      Filesize

      4KB

    • memory/1852-11-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB

    • memory/1852-12-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB

    • memory/1852-13-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB

    • memory/1852-14-0x00007FFAC74C0000-0x00007FFAC7E61000-memory.dmp

      Filesize

      9.6MB