Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 20:54

General

  • Target

    b0bfa73309e08e90a62c8d4847e73b104b773ac09fe37aefa94636f9eecc466f.exe

  • Size

    318KB

  • MD5

    6d16ebc84fcf1cddfb24ee8d5d54ac8e

  • SHA1

    e58e87c823429d7ed7a6e7fcae09b4a99b02f2a4

  • SHA256

    b0bfa73309e08e90a62c8d4847e73b104b773ac09fe37aefa94636f9eecc466f

  • SHA512

    58a6a277158762dcba8b0c3bd7a0275c19992b6cc96cb2215dfae2231c60190a0c5e2f2c9d8d6ea95716a7f8bc074b426ee18c9b8b69cb263a4a34a07cdd4aac

  • SSDEEP

    6144:qpmOMnq7jsDvszbMR8to/OWXWkWc6tsdj6c3I:qp3Muj8yXtormsCsBjI

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0bfa73309e08e90a62c8d4847e73b104b773ac09fe37aefa94636f9eecc466f.exe
    "C:\Users\Admin\AppData\Local\Temp\b0bfa73309e08e90a62c8d4847e73b104b773ac09fe37aefa94636f9eecc466f.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    • Modifies system certificate store
    PID:1324

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

    Filesize

    8KB

  • memory/1324-55-0x0000000000170000-0x000000000019F000-memory.dmp

    Filesize

    188KB

  • memory/1324-59-0x0000000003B00000-0x0000000003B27000-memory.dmp

    Filesize

    156KB