Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

skuld.exe

windows7-x64

1

skuld.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    91s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 22:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    skuld.exe

  • Size

    9.9MB

  • MD5

    c41bcb9a79f6642a41b2700cb6568d5f

  • SHA1

    0d3513ad6b40883d382be67fc06b0412186c2101

  • SHA256

    f42d031594a7899b74d6635aef7cb1f743a219bedc46dc6d5fe059c610b1b091

  • SHA512

    0c7445dfa9e808ae6b28777105c33a38d52d8c038ed77d7ab6f23a5112ca5015c57730c557fa588343001c3f8d6ba87fc2b4671a5db792ab48c3244940bc01fe

  • SSDEEP

    98304:KtKxH9nEaPLV9mx7bZqRQvKWmhAEbLGg7BDkF+dQq:KtInEaHEJqRQvjC5bC+Gq

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\skuld.exe
    "C:\Users\Admin\AppData\Local\Temp\skuld.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\skuld.exe
      2⤵
      • Views/modifies file attributes
      PID:4308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads