Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/01/2025, 00:39
250113-azpfhaxkdy 1013/01/2025, 00:01
250113-aaz6psykfm 1012/01/2025, 16:33
250112-t2lbeazlev 10Analysis
-
max time kernel
895s -
max time network
867s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
12/01/2025, 16:33
Behavioral task
behavioral1
Sample
sro.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
sro.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
sro.exe
Resource
win10ltsc2021-20241211-en
General
-
Target
sro.exe
-
Size
63KB
-
MD5
25b9a545a50344fba6466a63b52eb19c
-
SHA1
ebd591bc64b6ba9777615be2cd29e4df42440b3d
-
SHA256
5ad73a02b37b04f6c0b245582a1dad17888d3c340626b1a094d6237a37ced49b
-
SHA512
927769f4061045b6d86ceb16e32606288f4b8d8752d64d05f1d9c348ed818be0b6ad354194192945ed228655f0736204b566952c125d80a179c2353137a7b39e
-
SSDEEP
768:QvsM2sk/978SQC8A+XjpVqt04utME31+T4RSBGHmDbDXphioXxuk2ByNhCfSu0dP:j1/Md87uliYUb1hbwXQNTu0dpqKmY7
Malware Config
Extracted
asyncrat
Default
127.0.0.1:1111
http://daxon.giize.com:1111
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
Processes
-
C:\Users\Admin\AppData\Local\Temp\sro.exe"C:\Users\Admin\AppData\Local\Temp\sro.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4156,i,7725352229495460145,1654775800534747848,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:81⤵PID:3704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=3052,i,7725352229495460145,1654775800534747848,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:81⤵PID:2164
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=5080,i,7725352229495460145,1654775800534747848,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:81⤵PID:4336