Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
18/03/2025, 14:55
General
-
Target
Autoruns/autorunsc.exe
-
Size
701KB
-
MD5
1d4611e03d8f32ae08cf8ade9a958729
-
SHA1
a8a3504eaf57a7d640bd42b5d59d2b8afa3e5f33
-
SHA256
bfbcf41b4659a4f371d434fc92b0f13bd46cfb82b74910633e900008765bd6da
-
SHA512
b3114eb005aa1f5f855d86d846099d43b61bbc7353d3acec241a79b691f69080474d356d9e414dfb65036c9a36751d9839fef15f8115ea391e906a841eb52ea4
-
SSDEEP
12288:6p7RGU8Fyh5h1nRoKWoS+ajSUwDeFHvOfKf:6p8rqH1nuKWoS+9DUvdf
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Autoruns\autorunsc.exe"C:\Users\Admin\AppData\Local\Temp\Autoruns\autorunsc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken