Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    288s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2022, 22:22

General

  • Target

    789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe

  • Size

    2.6MB

  • MD5

    0c717a4d5c7c6a0716fa3d788f0b2cdd

  • SHA1

    ccebe3bfbd0f46942c27e898b67dcd56c2dd7e27

  • SHA256

    789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05

  • SHA512

    314e1c5b4569f7ca2db449f4fe5d86dd56972ae59c08ce82618d889c2c311b5d744cb4d52fd7f89411afc30c7e185d8ef46274e2b205076b584bb74a9dd997af

  • SSDEEP

    49152:DmVRGHUBcBLZ3K5va9tNCyK4Vs9mOpLbO88y8kiaAm3EmB5hwVjrrkxCP3RcdlsG:DmVRbO5Za5voN2aso4bOKiaB3Em1wht5

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe
    "C:\Users\Admin\AppData\Local\Temp\789630c437ccf2d7df712ce174ba2336792977a27d203431957c79163f9b9a05.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/996-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

    Filesize

    8KB

  • memory/996-55-0x00000000000F0000-0x00000000000F2000-memory.dmp

    Filesize

    8KB

  • memory/996-56-0x00000000000F0000-0x0000000000B1C000-memory.dmp

    Filesize

    10.2MB

  • memory/996-57-0x00000000000F0000-0x0000000000B1C000-memory.dmp

    Filesize

    10.2MB

  • memory/996-58-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

  • memory/996-59-0x00000000000F0000-0x0000000000B1C000-memory.dmp

    Filesize

    10.2MB