Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 14:12

General

  • Target

    15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe

  • Size

    115KB

  • MD5

    0f76cf7b3e144048f566941346c75e92

  • SHA1

    1c6a5e27fee8e7097861ad3badcf04fdf43c5b4c

  • SHA256

    15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd

  • SHA512

    63d5810622ff301593bf02a0e7660ad598996b4a5fb2808a995e56e9972d803383edafcde002ea0e0339423957768572a0f2d1ecf1ba5e807d32e7a1dc8b3011

  • SSDEEP

    3072:MfVp/jp0hYkB+y5z83cRJbAERDaJVsPrFgVUfIqVkS:MtpEYW+y632JkEMsqeIqV

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe
    "C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\mspaint.exe
        "C:\Windows\system32\mspaint.exe"
        3⤵
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1920
    • C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe
      "C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1860
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1212
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZLCBA5BZ.txt

    Filesize

    537B

    MD5

    b1a9816c0b45d2ab62e8aa8e0a74fdb8

    SHA1

    80e0ac4befa3cf5db82b6958f3754579a0d45133

    SHA256

    e5899bf3aa1cdc43dd67e14b5ac1cbfff42a0d8ed6fc27ae5ff438add3903bc7

    SHA512

    cbdc37adcb006e29d2c34f2044fe50063b757c9110ebbdb188f8dc0f8a2601024f7dd00d39d519813fabd283c02cd0635c4220eca3ac100c5f0db20bc850c833

  • memory/1612-110-0x0000000002D90000-0x0000000002DDE000-memory.dmp

    Filesize

    312KB

  • memory/1612-122-0x0000000002D90000-0x0000000002DDE000-memory.dmp

    Filesize

    312KB

  • memory/1612-321-0x0000000002C50000-0x0000000002E14000-memory.dmp

    Filesize

    1.8MB

  • memory/1612-116-0x0000000002D90000-0x0000000002DDE000-memory.dmp

    Filesize

    312KB

  • memory/1612-128-0x0000000002D90000-0x0000000002DDE000-memory.dmp

    Filesize

    312KB

  • memory/1612-91-0x0000000002D90000-0x0000000002DDE000-memory.dmp

    Filesize

    312KB

  • memory/1612-104-0x0000000002D90000-0x0000000002DDE000-memory.dmp

    Filesize

    312KB

  • memory/1612-55-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB

  • memory/1612-98-0x0000000002D90000-0x0000000002DDE000-memory.dmp

    Filesize

    312KB

  • memory/1612-73-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1612-74-0x0000000000220000-0x0000000000235000-memory.dmp

    Filesize

    84KB

  • memory/1612-75-0x0000000000280000-0x00000000002B5000-memory.dmp

    Filesize

    212KB

  • memory/1612-134-0x0000000002C50000-0x0000000002E14000-memory.dmp

    Filesize

    1.8MB

  • memory/1860-68-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-70-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-60-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-82-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-92-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-78-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-63-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-61-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1860-66-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1920-99-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1920-123-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1920-93-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1920-105-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1920-320-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1920-111-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1920-81-0x0000000000F11000-0x0000000000F13000-memory.dmp

    Filesize

    8KB

  • memory/1920-129-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1920-117-0x0000000004290000-0x00000000042DE000-memory.dmp

    Filesize

    312KB

  • memory/1952-100-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-124-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-118-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-112-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-106-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-130-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-94-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-138-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB

  • memory/1952-319-0x00000000000C0000-0x00000000000E1000-memory.dmp

    Filesize

    132KB

  • memory/1952-76-0x00000000000C0000-0x00000000000E1000-memory.dmp

    Filesize

    132KB

  • memory/1952-57-0x00000000000C0000-0x00000000000E1000-memory.dmp

    Filesize

    132KB

  • memory/1952-322-0x0000000000180000-0x00000000001CE000-memory.dmp

    Filesize

    312KB