Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 06:46

General

  • Target

    c835461958635e351f2327f1dc0e9e3d2173ca483168010edfc0c6e55c669140.exe

  • Size

    154KB

  • MD5

    6ae431501c93046b0b4122cba09e1070

  • SHA1

    63f09369c8a89df710e5ba498fa08f0217ff348f

  • SHA256

    c835461958635e351f2327f1dc0e9e3d2173ca483168010edfc0c6e55c669140

  • SHA512

    c3716a40bcd2ac340e5b9ad9ea99848f77afd462e53bb0e5b23fbdc064843c3d47efb7c61426573ff572bbd373f277a6abe3f6bf3237326ca3c33967c766ad9d

  • SSDEEP

    1536:TjHWUBjVLTfo9yUKFCBy2uvl/0yB+BwU0yHp3JJWKucqqUC:Tjtj5Tbd6mF0yQBVdJxPUC

Score
8/10

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c835461958635e351f2327f1dc0e9e3d2173ca483168010edfc0c6e55c669140.exe
    "C:\Users\Admin\AppData\Local\Temp\c835461958635e351f2327f1dc0e9e3d2173ca483168010edfc0c6e55c669140.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1212

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1212-54-0x000007FEF3B90000-0x000007FEF45B3000-memory.dmp

    Filesize

    10.1MB

  • memory/1212-55-0x000007FEF2AF0000-0x000007FEF3B86000-memory.dmp

    Filesize

    16.6MB

  • memory/1212-56-0x0000000000A36000-0x0000000000A55000-memory.dmp

    Filesize

    124KB

  • memory/1212-57-0x0000000000A36000-0x0000000000A55000-memory.dmp

    Filesize

    124KB