Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07/11/2022, 10:54
General
-
Target
b921ad3673e52c1e1c0596f75fb8ccf0464bb98838f926f7c975a660188d95b3.exe
-
Size
313KB
-
MD5
20055c8671238163ca143a2929be39f6
-
SHA1
034b708b06429f36a7952d5e2929f87d6de9134c
-
SHA256
b921ad3673e52c1e1c0596f75fb8ccf0464bb98838f926f7c975a660188d95b3
-
SHA512
c8cde8c7153fc6f77b9ff70fc457cc9d2874d526d5a268df9fd6aac7e5c3c32d9358873c2d1c2dd595c0cb970a23b909345d9baa495404a2d43fa8ac855aa9aa
-
SSDEEP
6144:HpfHJ08j1FY6zj9KjkurnbQtqCg2hh/j6n8aJsdKPGL96eYyjKwpCDih9:ZHJN1FJpKjkuTUta23/Bae5UeYyADiH
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b921ad3673e52c1e1c0596f75fb8ccf0464bb98838f926f7c975a660188d95b3.exe"C:\Users\Admin\AppData\Local\Temp\b921ad3673e52c1e1c0596f75fb8ccf0464bb98838f926f7c975a660188d95b3.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\de-DE1.exeC:\Windows\SysWOW64\de-DE1.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins3493.bat "C:\Users\Admin\AppData\Local\Temp\b921ad3673e52c1e1c0596f75fb8ccf0464bb98838f926f7c975a660188d95b3.exe"2⤵
- Deletes itself
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
138KB
MD50e308da35b0ba1f91c122b1764a944ea
SHA1bd4fe0e789ac3d46220e9fb7cf64cb02abd7a96a
SHA256b50c611f9625dd59ea93852287df32b0035a743c12ffe8721aebcb07e4420db3
SHA512a7490e442d5c5114b22b69346e3cb092ef025229f2b097586ab80a8dd5aace148f58746507bb1af585cb501db2f83ebf3b7bf5fd33471552df3a5048e2c37e82
-
Filesize
138KB
MD50e308da35b0ba1f91c122b1764a944ea
SHA1bd4fe0e789ac3d46220e9fb7cf64cb02abd7a96a
SHA256b50c611f9625dd59ea93852287df32b0035a743c12ffe8721aebcb07e4420db3
SHA512a7490e442d5c5114b22b69346e3cb092ef025229f2b097586ab80a8dd5aace148f58746507bb1af585cb501db2f83ebf3b7bf5fd33471552df3a5048e2c37e82
-
Filesize
138KB
MD50e308da35b0ba1f91c122b1764a944ea
SHA1bd4fe0e789ac3d46220e9fb7cf64cb02abd7a96a
SHA256b50c611f9625dd59ea93852287df32b0035a743c12ffe8721aebcb07e4420db3
SHA512a7490e442d5c5114b22b69346e3cb092ef025229f2b097586ab80a8dd5aace148f58746507bb1af585cb501db2f83ebf3b7bf5fd33471552df3a5048e2c37e82
-
Filesize
248KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
8KB
-
Filesize
388KB
-
Filesize
1024KB
-
Filesize
644KB
-
Filesize
644KB
-
Filesize
644KB
-
Filesize
1024KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
644KB
-
Filesize
5.7MB
-
Filesize
5.7MB