Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    163s
  • max time network
    191s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    15/02/2022, 16:02

General

  • Target

    0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924.exe

  • Size

    5.2MB

  • MD5

    9e341e85dcaa0a31a88ad14feaeed888

  • SHA1

    0ba9508166b2f8127451e07a1ceffd9ec63fd640

  • SHA256

    0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924

  • SHA512

    cc2b7efe29bafae98b174129c3bd6da61f4f9051247ad9dd09b86843e7e6502958e1d1d70da332e5e63e73bff7e97514dd9f303de6baf3233662508ed1595db5

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924.exe
    "C:\Users\Admin\AppData\Local\Temp\0333988d52da8b27e865657ffa2c4cb8e96b43fce7d6d7b72458a0b176713924.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\7zS06659766\GenericSetup.exe
      .\GenericSetup.exe
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:1712

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1632-55-0x0000000075021000-0x0000000075023000-memory.dmp

    Filesize

    8KB

  • memory/1712-62-0x0000000001080000-0x0000000001AB0000-memory.dmp

    Filesize

    10.2MB

  • memory/1712-59-0x000000007400E000-0x000000007400F000-memory.dmp

    Filesize

    4KB

  • memory/1712-63-0x00000000056A0000-0x00000000056A1000-memory.dmp

    Filesize

    4KB

  • memory/1712-64-0x0000000005AD0000-0x00000000061AA000-memory.dmp

    Filesize

    6.9MB

  • memory/1712-65-0x0000000000410000-0x0000000000418000-memory.dmp

    Filesize

    32KB

  • memory/1712-66-0x00000000004B0000-0x00000000004D8000-memory.dmp

    Filesize

    160KB

  • memory/1712-67-0x0000000000B30000-0x0000000000B5C000-memory.dmp

    Filesize

    176KB

  • memory/1712-68-0x0000000000C50000-0x0000000000C62000-memory.dmp

    Filesize

    72KB