Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 22:00

General

  • Target

    f56e51959e7d56c18f380f5a9ef77e4ddd8d83840d8d23e296e67bd9091d9ebf.exe

  • Size

    63KB

  • MD5

    5743d163d21d7fd3f636f72e90d23205

  • SHA1

    74a0c3592970b5012e98e0cc968b67fb87a66b4a

  • SHA256

    f56e51959e7d56c18f380f5a9ef77e4ddd8d83840d8d23e296e67bd9091d9ebf

  • SHA512

    29c993474bc4ec355f9cc8a54b28dbddcbece7b1697d80430fce36cb6513c679b53d9db9abb4b38741d901bf719c07ca7ff1800c02708634eacb25715acbd7ce

  • SSDEEP

    1536:7v0CePVW5K2uKqxFhphwshnxmYwY3inhJ:7aNW5HuKqxHphwsSYjIJ

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f56e51959e7d56c18f380f5a9ef77e4ddd8d83840d8d23e296e67bd9091d9ebf.exe
    "C:\Users\Admin\AppData\Local\Temp\f56e51959e7d56c18f380f5a9ef77e4ddd8d83840d8d23e296e67bd9091d9ebf.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: MapViewOfSection
    PID:1600
  • C:\Windows\syswow64\svchost.exe
    "C:\Windows\syswow64\svchost.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1276

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1232-59-0x00000000772D0000-0x0000000077479000-memory.dmp

    Filesize

    1.7MB

  • memory/1232-61-0x0000000002220000-0x0000000002227000-memory.dmp

    Filesize

    28KB

  • memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

    Filesize

    8KB

  • memory/1600-55-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1600-56-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1600-57-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1600-58-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB