Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

f6d02df1b7...3a.exe

windows7-x64

10

f6d02df1b7...3a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    90s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 01:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6d02df1b7cf2918b0db7eed1a26465230e21d59cc228445df9dc3b11fed4d3a.exe

  • Size

    258KB

  • MD5

    364d96ade7f51ad0b5cfb4513380d250

  • SHA1

    27dc15b1463b56aee1caeb6f7a40e01fba09e18c

  • SHA256

    f6d02df1b7cf2918b0db7eed1a26465230e21d59cc228445df9dc3b11fed4d3a

  • SHA512

    d5415920df33bad5d831868c140724a23b10c21a9bafefcaf0458e563acbfdaf919a7d4c773a7a6baf82b1c4297059092bc05e628449039b1619911547d19520

  • SSDEEP

    3072:u0D/btiXVuEqYOgUGmaDTXwYPFP0+OyQQP8zR68usNR/SL8zCXm1RLCy6OkhfoRs:/piQlg5TAYJrOyQQP8ENERI8KAFGOIV

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6d02df1b7cf2918b0db7eed1a26465230e21d59cc228445df9dc3b11fed4d3a.exe
    "C:\Users\Admin\AppData\Local\Temp\f6d02df1b7cf2918b0db7eed1a26465230e21d59cc228445df9dc3b11fed4d3a.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:1376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Google\Desktop\Install\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\ \...\‮ﯹ๛\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@
    Filesize

    2KB

    MD5

    42998835b58e80c864c4115db272ec70

    SHA1

    af13f966d81b3dd8679eb3fa26fa67d7a81a105c

    SHA256

    a4085ce77a63327754d4925c9993479ae447051add9044ec482caf448b543799

    SHA512

    1e34e83f2050d83a45636ffbfc71ae31b03a910c633aac407a87cae541c439410271b87ac36a9fe213304c2d37002d7ddbbc76b3a147fe90051ea4ec552e1158

    Download Submit

  • memory/460-60-0x0000000000120000-0x0000000000132000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1212-59-0x0000000002240000-0x0000000002252000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1980-54-0x0000000075521000-0x0000000075523000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1980-55-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/1980-57-0x00000000004D0000-0x00000000004F6000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1980-58-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/1980-62-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download