Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
11/03/2025, 16:30
250311-tz8zpaxrz2 1011/03/2025, 16:06
250311-tkc9gaxm16 1011/03/2025, 16:06
250311-tj3sqsxm13 1010/03/2025, 17:34
250310-v5yatasnz9 1020/02/2025, 10:50
250220-mw8festjaz 1020/02/2025, 10:49
250220-mw12cavpw6 1016/02/2025, 02:33
250216-c1244ayjc1 1016/02/2025, 02:26
250216-cw6xgsxldq 1012/02/2025, 14:54
250212-r9zgwswmej 1012/02/2025, 14:27
250212-rsdtvsvqet 10Analysis
-
max time kernel
26s -
max time network
7s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
-
submitted
11/03/2025, 16:30
General
-
Target
beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
-
Size
8.5MB
-
MD5
2d690d32e637c43a18aa8f4f2fd28e48
-
SHA1
f8a5f75a34d2751c0e7195cd4adabddc1ece465e
-
SHA256
beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
-
SHA512
2641192c4ebb0a66fdf6a9be16ccfc38a4cd98a32467d5b6e719c73b2893a28888b7c9c77d3db3a0d2e93d14408081bdc92238dc3a5b1479229843f354c7305e
-
SSDEEP
196608:exCyu9hdCjcHsm2gTEE/OBBZVaMKb0QqNnJi6lWzVYK5P6qwpxFlWavvy7:ervy
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 22 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e91⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB