Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 09:03

General

  • Target

    32010c1fff1a07ec4c398d0d307100b98dabe7ee07b06eca4f5b7a41bbeb2174.exe

  • Size

    868KB

  • MD5

    7baa94cbbb8fc220c03e33f959e03260

  • SHA1

    65ef00aa3b8ac30bead6c9830eaf4a06e2e5b9cb

  • SHA256

    32010c1fff1a07ec4c398d0d307100b98dabe7ee07b06eca4f5b7a41bbeb2174

  • SHA512

    b18a2fa395234902426cca60b7c95ec8176307c527d9e8e23c48aa0d09d269af4ff766a4d83c08ef133de9fda6abe9a0f340b17883f192483f58dbb2e0826661

  • SSDEEP

    24576:lrxJB0/I+CMii6I32OVWP1zjaNilwqcyC4AgCg6+:VxJSwDMii6KQ1XaEUq6

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\32010c1fff1a07ec4c398d0d307100b98dabe7ee07b06eca4f5b7a41bbeb2174.exe
    "C:\Users\Admin\AppData\Local\Temp\32010c1fff1a07ec4c398d0d307100b98dabe7ee07b06eca4f5b7a41bbeb2174.exe"
    1⤵
    • Adds Run key to start application
    • Checks processor information in registry
    PID:1628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1628-54-0x0000000075831000-0x0000000075833000-memory.dmp

    Filesize

    8KB

  • memory/1628-55-0x0000000000840000-0x0000000000910000-memory.dmp

    Filesize

    832KB

  • memory/1628-56-0x0000000000910000-0x00000000009DE000-memory.dmp

    Filesize

    824KB

  • memory/1628-57-0x00000000010B0000-0x00000000012F6000-memory.dmp

    Filesize

    2.3MB

  • memory/1628-58-0x00000000010B0000-0x00000000012F6000-memory.dmp

    Filesize

    2.3MB