Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 15:30

General

  • Target

    3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8.exe

  • Size

    100KB

  • MD5

    0a211a2cb79a221b59cd53fa159350d2

  • SHA1

    9b34a62a248514dc64c1d91a0edb52fe29028a86

  • SHA256

    3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8

  • SHA512

    805c6c788a6cdac984278494c53e73c586f01902c9e1b5e5a5b89208ba9f710d378a97b861ba0ef19cebe3719cb93207792a9f495d23c91a15898339075859b0

  • SSDEEP

    1536:25zsDNdr46AqK/b7xMdIi8stfIEtJxPKWgd8kNycHWf:+67K/b1Qf86xPk8kscHWf

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8.exe
    "C:\Users\Admin\AppData\Local\Temp\3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8.exe
      "C:\Users\Admin\AppData\Local\Temp\3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8.exe"
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\tcptsys.exe
        "C:\Windows\tcptsys.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Windows\tcptsys.exe
          "C:\Windows\tcptsys.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1156

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\tcptsys.exe

    Filesize

    100KB

    MD5

    0a211a2cb79a221b59cd53fa159350d2

    SHA1

    9b34a62a248514dc64c1d91a0edb52fe29028a86

    SHA256

    3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8

    SHA512

    805c6c788a6cdac984278494c53e73c586f01902c9e1b5e5a5b89208ba9f710d378a97b861ba0ef19cebe3719cb93207792a9f495d23c91a15898339075859b0

  • C:\Windows\tcptsys.exe

    Filesize

    100KB

    MD5

    0a211a2cb79a221b59cd53fa159350d2

    SHA1

    9b34a62a248514dc64c1d91a0edb52fe29028a86

    SHA256

    3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8

    SHA512

    805c6c788a6cdac984278494c53e73c586f01902c9e1b5e5a5b89208ba9f710d378a97b861ba0ef19cebe3719cb93207792a9f495d23c91a15898339075859b0

  • C:\Windows\tcptsys.exe

    Filesize

    100KB

    MD5

    0a211a2cb79a221b59cd53fa159350d2

    SHA1

    9b34a62a248514dc64c1d91a0edb52fe29028a86

    SHA256

    3361935bbe0f9d1d4fd2cd52d0dcf65e1800fab297abac7341e450b6d407e8d8

    SHA512

    805c6c788a6cdac984278494c53e73c586f01902c9e1b5e5a5b89208ba9f710d378a97b861ba0ef19cebe3719cb93207792a9f495d23c91a15898339075859b0

  • memory/756-65-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1156-90-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1400-79-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1400-88-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1976-75-0x0000000000460000-0x000000000047A000-memory.dmp

    Filesize

    104KB

  • memory/1976-62-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1976-74-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1976-66-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1976-78-0x0000000000460000-0x000000000047A000-memory.dmp

    Filesize

    104KB

  • memory/1976-56-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1976-60-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1976-59-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/1976-67-0x0000000075831000-0x0000000075833000-memory.dmp

    Filesize

    8KB

  • memory/1976-57-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB