Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    170s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 19:54

General

  • Target

    accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe

  • Size

    1.1MB

  • MD5

    4c4a1796e61e532a3a9108c705f5b74e

  • SHA1

    2a6bc5c5cdcefac83bd47b58761690bc4dfb4284

  • SHA256

    accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d

  • SHA512

    024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa

  • SSDEEP

    24576:ubq0z+FMnSJU96SyN+rsbvco1Pc9McNC1Dy4D6N+/GtD9M7SW0LvZkDV:ubx8MSJfT+rsbPK93NSDB+N+QO3NDV

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe
    "C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe
      "C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\adobereader.exe" "Adobe Driver Update" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:1652
      • C:\Users\Admin\AppData\Local\Temp\adobereader.exe
        "C:\Users\Admin\AppData\Local\Temp\adobereader.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Users\Admin\AppData\Local\Temp\adobereader.exe
          "C:\Users\Admin\AppData\Local\Temp\adobereader.exe"
          4⤵
          • Executes dropped EXE
          PID:268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\adobereader.exe

    Filesize

    1.1MB

    MD5

    4c4a1796e61e532a3a9108c705f5b74e

    SHA1

    2a6bc5c5cdcefac83bd47b58761690bc4dfb4284

    SHA256

    accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d

    SHA512

    024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa

  • C:\Users\Admin\AppData\Local\Temp\adobereader.exe

    Filesize

    1.1MB

    MD5

    4c4a1796e61e532a3a9108c705f5b74e

    SHA1

    2a6bc5c5cdcefac83bd47b58761690bc4dfb4284

    SHA256

    accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d

    SHA512

    024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa

  • C:\Users\Admin\AppData\Local\Temp\adobereader.exe

    Filesize

    1.1MB

    MD5

    4c4a1796e61e532a3a9108c705f5b74e

    SHA1

    2a6bc5c5cdcefac83bd47b58761690bc4dfb4284

    SHA256

    accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d

    SHA512

    024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa

  • \Users\Admin\AppData\Local\Temp\adobereader.exe

    Filesize

    1.1MB

    MD5

    4c4a1796e61e532a3a9108c705f5b74e

    SHA1

    2a6bc5c5cdcefac83bd47b58761690bc4dfb4284

    SHA256

    accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d

    SHA512

    024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa

  • \Users\Admin\AppData\Local\Temp\adobereader.exe

    Filesize

    1.1MB

    MD5

    4c4a1796e61e532a3a9108c705f5b74e

    SHA1

    2a6bc5c5cdcefac83bd47b58761690bc4dfb4284

    SHA256

    accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d

    SHA512

    024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa

  • memory/268-92-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-62-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-60-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-65-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-56-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-64-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-73-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-59-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1696-76-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1744-74-0x0000000000400000-0x00000000007BC000-memory.dmp

    Filesize

    3.7MB

  • memory/1744-89-0x0000000000400000-0x00000000007BC000-memory.dmp

    Filesize

    3.7MB

  • memory/2016-54-0x0000000075201000-0x0000000075203000-memory.dmp

    Filesize

    8KB

  • memory/2016-66-0x0000000000400000-0x00000000007BC000-memory.dmp

    Filesize

    3.7MB

  • memory/2016-55-0x0000000000400000-0x00000000007BC000-memory.dmp

    Filesize

    3.7MB