Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 06:44

General

  • Target

    fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe

  • Size

    208KB

  • MD5

    0a6ad25f8f0f2b4633f52a363025e5d1

  • SHA1

    ffac6af75164b16ec7c376314ef317dc02a608c5

  • SHA256

    fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e

  • SHA512

    7b7796eb2cad9883c99a3f8f0778532240fb708f0c6c9ec0439626a5b326d4828f273eaa54f4bd8f6e316e6cf3104cbbd53abb918acc8af66d86c4730e819e4a

  • SSDEEP

    3072:8XNtb9fQZn/jMTnORtoV2oR680sQewQbmJMM1rA+8B:8L9oVIFV2oR93wQU1AZB

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe
    "C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe
      "C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1656
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\28WVZMI2.txt

    Filesize

    603B

    MD5

    31eb96f80fa767d55e4990600e3f929d

    SHA1

    243790cd60ec9f106ecf8f105c6af816cdd62890

    SHA256

    3b539fdc694b500ed8eb09f47e45ed1bff0c714371f55ed3bfaef3572606b8a6

    SHA512

    7b1aed8b7b79c1d78c23bab64509cbc8b59eedfdff6c88f9d81b8d58db0509147a2fa6e228446fdfc153ceb702d4034302847fc940cd7247397d7c76198414c0

  • memory/972-89-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-83-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-58-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-60-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-62-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-64-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-55-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-69-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-68-0x0000000076461000-0x0000000076463000-memory.dmp

    Filesize

    8KB

  • memory/972-70-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-73-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-75-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-77-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-79-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-81-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-135-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-85-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-56-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/972-87-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-97-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-93-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-95-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-91-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-99-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-101-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-103-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-105-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-107-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-109-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-111-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-113-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-115-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-117-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-119-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-121-0x0000000000360000-0x00000000003AF000-memory.dmp

    Filesize

    316KB

  • memory/972-134-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/1604-54-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1604-67-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB