Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 12:02

General

  • Target

    827ae5a3d83b59edb5bf82da456eb17ae2f2e8f3a56a9b64b32f10d630408acf.exe

  • Size

    57KB

  • MD5

    0c8fe92ae600f0f2c00fff0d5000baf0

  • SHA1

    7430e391ddaa148e98105baabb3d8374f0cb6709

  • SHA256

    827ae5a3d83b59edb5bf82da456eb17ae2f2e8f3a56a9b64b32f10d630408acf

  • SHA512

    6e8f2211a1bd187d4983b7e4c264b1ba58f5664c24aa876535a3ad8061fa82116a24f1ecbd4d697b3812d33ca368a9569f4a9f1df4518862ad0145e4730637e4

  • SSDEEP

    1536:ColLryjTkegAtH/wPYBjoE53mw7xFLgyn:D2U6wPUoMmSj

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\827ae5a3d83b59edb5bf82da456eb17ae2f2e8f3a56a9b64b32f10d630408acf.exe
      "C:\Users\Admin\AppData\Local\Temp\827ae5a3d83b59edb5bf82da456eb17ae2f2e8f3a56a9b64b32f10d630408acf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Users\Admin\AppData\Local\Temp\827ae5a3d83b59edb5bf82da456eb17ae2f2e8f3a56a9b64b32f10d630408acf.exe
        C:\Users\Admin\AppData\Local\Temp\827ae5a3d83b59edb5bf82da456eb17ae2f2e8f3a56a9b64b32f10d630408acf.exe
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of WriteProcessMemory
          PID:1756
    • C:\Windows\syswow64\svchost.exe
      "C:\Windows\syswow64\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\SysWOW64\ctfmon.exe
        ctfmon.exe
        3⤵
        • Suspicious use of FindShellTrayWindow
        PID:1732

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1112-54-0x0000000076031000-0x0000000076033000-memory.dmp

    Filesize

    8KB

  • memory/1284-66-0x0000000002680000-0x0000000002689000-memory.dmp

    Filesize

    36KB

  • memory/1560-73-0x0000000000080000-0x0000000000089000-memory.dmp

    Filesize

    36KB

  • memory/1560-70-0x0000000000080000-0x0000000000089000-memory.dmp

    Filesize

    36KB

  • memory/1756-68-0x00000000FF4C0000-0x00000000FF780000-memory.dmp

    Filesize

    2.8MB

  • memory/1756-69-0x0000000000030000-0x0000000000040000-memory.dmp

    Filesize

    64KB

  • memory/1928-59-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1928-64-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1928-67-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1928-63-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1928-60-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1928-57-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1928-56-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1928-55-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB