Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 16:37

General

  • Target

    8887b8d605199246e89e5a7b7c4096c8d25730504fc3d1054962aa7f2e9363ca.exe

  • Size

    80KB

  • MD5

    822dacc7534b8389dca55cb52df3abb0

  • SHA1

    7c787f2147ad58e810e24ec900e87750c6c4b873

  • SHA256

    8887b8d605199246e89e5a7b7c4096c8d25730504fc3d1054962aa7f2e9363ca

  • SHA512

    0e33264a9e14b129be9a38cf52be8ba19c5e78b6ea1d107761f66fd32257aec9a7af7c2efb7b77dd56b11e5b94c26f752db3827078da7f9bd7791539dcf28277

  • SSDEEP

    1536:aI0vo8+wBW7w+NlRSab43E0ZS9skC7lu5L/Odgc9zW:cvok+vMab4joskQuhOWe

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8887b8d605199246e89e5a7b7c4096c8d25730504fc3d1054962aa7f2e9363ca.exe
    "C:\Users\Admin\AppData\Local\Temp\8887b8d605199246e89e5a7b7c4096c8d25730504fc3d1054962aa7f2e9363ca.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: MapViewOfSection
    PID:908
  • C:\Windows\syswow64\svchost.exe
    "C:\Windows\syswow64\svchost.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1408

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/908-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

    Filesize

    8KB

  • memory/908-56-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/908-55-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/908-57-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/908-58-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1216-59-0x00000000772E0000-0x0000000077489000-memory.dmp

    Filesize

    1.7MB

  • memory/1216-60-0x0000000002AD0000-0x0000000002AD7000-memory.dmp

    Filesize

    28KB