Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
11/03/2025, 07:56
General
-
Target
10ebd229b72489e6960490381681c51b84b6a0430cfc5fd556edae41b0871409.exe
-
Size
21.8MB
-
MD5
53d77e893eadb542ec6ed0205edb0426
-
SHA1
9f64ea0034fb697f2e79bbc765744dc94d56f363
-
SHA256
10ebd229b72489e6960490381681c51b84b6a0430cfc5fd556edae41b0871409
-
SHA512
25e6c899034b2cb7c2e58025c88136e1f13e336dd6083031664687666bb64489c0309c26e1e0ebd86f1ffa3202d81ad3fb134be07074752bb05640201ca34cdc
-
SSDEEP
393216:8YGbY6iHonlQCe88BYdY3SHFPJXFODKSbT3DIfpTwmZf0of12Wmv2ZyX+vVAAc:87Y2CCe4dAmFOmSPMhpfTf15mv2ZyURc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\10ebd229b72489e6960490381681c51b84b6a0430cfc5fd556edae41b0871409.exe"C:\Users\Admin\AppData\Local\Temp\10ebd229b72489e6960490381681c51b84b6a0430cfc5fd556edae41b0871409.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn KMSAuto-AActtive-API /tr "C:\ProgramData\KMSAuto\AActtive.exe" /st 08:04 /du 23:59 /sc daily /ri 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\KMSAuto\AActtive.exe"C:\ProgramData\KMSAuto\AActtive.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1E8F.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 63⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.4MB
MD5d8b828be837168fa09f60ef13219ad77
SHA1e06f14be275aa6780d576bc025064bd41a3e8a3d
SHA256e7654cbc4dd68619dd316d6e0a5dc1e6c7e925ebe23553d7fcec961b58ebf81c
SHA5127ebf3ff4009001b4023f20959bef660d1f5da31f2a97381628158f2db9544275f0bb643d202a97e574d50a116a5cf5480f466f3b2e45fc1c797615e6ab511165
-
Filesize
216B
MD5d9a5387907e86c7a2af2b12f32ce7be8
SHA1847e5e7e992e979c5736bdbe7b395aa3db217fd6
SHA2560da071fbb68753fb59c301f7a45249856632bb1762bb96f565a9d30fc4afdc85
SHA5121ab2fc1f08cf7bb4f099535b2da70c3937bd719a86c3b24b81db59d58e4569b502c04558a1483f535f915a7fe826c97dedf8b5bb70a92d28594eaeecbd999b22
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
264KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.0MB