Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 07:26

General

  • Target

    ca871748d311d256b2294e3e8f0a90b4e63ce1156b1819a39dede638200de410.exe

  • Size

    768KB

  • MD5

    09fbd3868bc24586c4f466da14da28f6

  • SHA1

    ee79316f0ff26e2ce76a0e5862b3486b75fd9e30

  • SHA256

    ca871748d311d256b2294e3e8f0a90b4e63ce1156b1819a39dede638200de410

  • SHA512

    a9af955d13c5115b5c9f1b72218ed25152d985311f38c64705c39a6df6ce7649f83dd0ff11ec31d9ca95721c47275b603802e2491526e602b60526762aa39a1a

  • SSDEEP

    12288:cBKS5nMBndmIwDZILsXcEgv4+DXk9EyhsBn8fvDyV++9wyP2cywRIZ:UJMmD+7A+DU9An8fre+sH+cJO

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca871748d311d256b2294e3e8f0a90b4e63ce1156b1819a39dede638200de410.exe
    "C:\Users\Admin\AppData\Local\Temp\ca871748d311d256b2294e3e8f0a90b4e63ce1156b1819a39dede638200de410.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\ca871748d311d256b2294e3e8f0a90b4e63ce1156b1819a39dede638200de410.exe
      C:\Users\Admin\AppData\Local\Temp\ca871748d311d256b2294e3e8f0a90b4e63ce1156b1819a39dede638200de410.exe
      2⤵
      • Enumerates VirtualBox registry keys
      • Suspicious behavior: EnumeratesProcesses
      PID:844

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/844-54-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-55-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-57-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-60-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-63-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-66-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-69-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-72-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-75-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-78-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-81-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-84-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-87-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB

  • memory/844-90-0x0000000075601000-0x0000000075603000-memory.dmp

    Filesize

    8KB

  • memory/844-91-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB