Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 00:55

General

  • Target

    91042817a468fc6be27d3d222d2f1432a8eb8d858ad9408510636469501f22d4.exe

  • Size

    642KB

  • MD5

    915ec3830ec0f93cb7f41fb261e46610

  • SHA1

    b7d35e103986581d4ad6596c281c6efb6798031e

  • SHA256

    91042817a468fc6be27d3d222d2f1432a8eb8d858ad9408510636469501f22d4

  • SHA512

    0df414cdb6148acd6f0c0071931eadbf81554dc353e4ea5bca923b89278e7f650b8979bc9d0645f2a9c922b434bd6049db70df65a6ad78025cdb8e7b4e2b52b1

  • SSDEEP

    12288:HxBputUUZyTYqC3XpYYm9E0lvjaE9zt6WxF6dBRlz:Hx4ZfqmXOf9E0lLaE9ztXqRl

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91042817a468fc6be27d3d222d2f1432a8eb8d858ad9408510636469501f22d4.exe
    "C:\Users\Admin\AppData\Local\Temp\91042817a468fc6be27d3d222d2f1432a8eb8d858ad9408510636469501f22d4.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1692-54-0x00000000003A0000-0x00000000003B5000-memory.dmp

    Filesize

    84KB

  • memory/1692-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

    Filesize

    8KB

  • memory/1692-56-0x0000000000400000-0x00000000004FE000-memory.dmp

    Filesize

    1016KB