Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:10
General
-
Target
4175909fcd35882461a1cfd784f7c967.exe
-
Size
17.7MB
-
MD5
4175909fcd35882461a1cfd784f7c967
-
SHA1
97c039024a434f8605ca06df16ee7355fd380e0d
-
SHA256
34a347012a452bb37b3da0cead9eaf007ec0e82a26b90ee1155ca8135bccd537
-
SHA512
ccf29163313a378c4d908e1ac400afc6299e5a2046b206f0eed46ccd0779f9bcb2a0162bb86db64504c71cfeb76df056dca621a4e1f267e28258ce5c10721c57
-
SSDEEP
393216:8YGbY6iHonlQCe88BYdY3SHFPJXFODKSblmnTCAc:87Y2CCe4dAmFOmSJme5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4175909fcd35882461a1cfd784f7c967.exe"C:\Users\Admin\AppData\Local\Temp\4175909fcd35882461a1cfd784f7c967.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn KMSAuto-AActtive-API /tr "C:\ProgramData\KMSAuto\AActtive.exe" /st 06:21 /du 23:59 /sc daily /ri 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\KMSAuto\AActtive.exe"C:\ProgramData\KMSAuto\AActtive.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDA24.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 63⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.4MB
MD516fc7866551afa383709f2230be08393
SHA1aaaeb1a69ae0a53727571f281c8c11a13e3f5ef3
SHA25642c780802b8dbd01691ed5f8a776fb8e2ecc5605026513fb4f19360088db58b2
SHA512a4efafd4f96a21dbc5437b8e0e74b05424776f8988c4e301109789b0c87f0f4718c0ab43b24c3373459101a0d6c5053d9ad34fd1a647394fc8f251ba1fc09c3c
-
Filesize
184B
MD50acd9248fb6730221f147baacb21bb1c
SHA12d77c47dfc785b2643dc6d853a68f6345ed0e071
SHA2568121c2ec32bcf9c87c12c5447f562d7b658e349efc0c879d4627ed192602d252
SHA5127351876177d3fc04ea296879455c537e7800e1aa4b0bb00d0186415aa0aa4001b8f385709328e1c2e40aa3be9bfce4ef204f67486d8ab3386787445d68d988e5
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
264KB