Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    106s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2025, 16:35

General

  • Target

    bin2local/bin/ControlzEx.pdb

  • Size

    685KB

  • MD5

    95ad9dc53d104d709ee179d85ce83def

  • SHA1

    c7bed5d7fe6421c547c4cbde7c986984cd6aea21

  • SHA256

    b46feb5b41a16f6dcf37001f5775ba59a1e4cf9eb7d0665f1724b917c30a3983

  • SHA512

    3e5593f2d573b3a5bfa05408d409c2d562c90dd700b98b9c8a63454249ed69f71add820e1a0ec71b009ba05ce4f438683ec5e0ae99a27be2df87af66e11b5981

  • SSDEEP

    6144:0pr12iW1CzyRJywCHyL/+/d5Zbk3RCLhr2a9fucQaVK60RyOKpvDi2jf5sxpr12d:0ph12XyhH8pxbp60cpcph12XyhHNr

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\bin2local\bin\ControlzEx.pdb
    1⤵
    • Modifies registry class
    PID:3980
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads