Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2025, 18:37

General

  • Target

    HacKed.facebooek‮exe.scr

  • Size

    235KB

  • MD5

    b09e2e1281495fa1ee6d1dcdb12c3218

  • SHA1

    71855f7712a915afc5e0c9823db288c936186323

  • SHA256

    8786009a7fdfc83d7585aae40754a3d5c8230ccb33943e92e964dac02bf330ca

  • SHA512

    fef2bcf896960056c5237f0513d91294706eb113497fe83fd4b03d2a5c47d57b012c905cecb5bfe0bf56c02d7af25e83f29b4d37d44e8c4c3dda6819d8127d9b

  • SSDEEP

    6144:m+S79QUEtQ3B5A6Ci3joVGCRiBUkgCNN+uwwL:EZApxBRu1gCCud

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HacKed.facebooek‮exe.scr
    "C:\Users\Admin\AppData\Local\Temp\HacKed.facebooek‮exe.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 752
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2488-0-0x00007FFFAC835000-0x00007FFFAC836000-memory.dmp

    Filesize

    4KB

  • memory/2488-1-0x00007FFFAC580000-0x00007FFFACF21000-memory.dmp

    Filesize

    9.6MB

  • memory/2488-2-0x00007FFFAC580000-0x00007FFFACF21000-memory.dmp

    Filesize

    9.6MB

  • memory/2488-9-0x00007FFFAC580000-0x00007FFFACF21000-memory.dmp

    Filesize

    9.6MB