Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    203s
  • max time network
    89s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 21:42

General

  • Target

    8ba296160b0a3426899c2167ef537ccc567d8046ad34cfadf42bc304164c4850.exe

  • Size

    396KB

  • MD5

    5328ae97cf6d14c37b1e22e32c65d790

  • SHA1

    06a0c7df8801e8de881215905c85ae0b953799aa

  • SHA256

    8ba296160b0a3426899c2167ef537ccc567d8046ad34cfadf42bc304164c4850

  • SHA512

    d0cc06a61fb9f8280ce9a6811cbf33d312aff4e1b062ae8ec6c1b634bf98692af092d9e41e9bee7ce4ba3c6992e9fe1ad7f8fa0f87b7613b7698c1cd734abdc2

  • SSDEEP

    6144:kwuK/7e2njWUrrZzNrtV5knaZS0pl22RTHT6tQD44btL0oLEaqHP4RO8QWoSwaP:k/KpWYl5nxZvlRbT66DbBxvQWoSw

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1372
      • C:\Users\Admin\AppData\Local\Temp\8ba296160b0a3426899c2167ef537ccc567d8046ad34cfadf42bc304164c4850.exe
        "C:\Users\Admin\AppData\Local\Temp\8ba296160b0a3426899c2167ef537ccc567d8046ad34cfadf42bc304164c4850.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Users\Admin\AppData\Local\Temp\8ba296160b0a3426899c2167ef537ccc567d8046ad34cfadf42bc304164c4850.exe
          "C:\Users\Admin\AppData\Local\Temp\8ba296160b0a3426899c2167ef537ccc567d8046ad34cfadf42bc304164c4850.exe"
          3⤵
          • Identifies Wine through registry keys
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1992

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1372-69-0x0000000002760000-0x0000000002761000-memory.dmp

      Filesize

      4KB

    • memory/1896-62-0x0000000000400000-0x000000000050C000-memory.dmp

      Filesize

      1.0MB

    • memory/1896-71-0x0000000000400000-0x000000000050C000-memory.dmp

      Filesize

      1.0MB

    • memory/1896-63-0x0000000001F90000-0x000000000209C000-memory.dmp

      Filesize

      1.0MB

    • memory/1896-54-0x0000000076691000-0x0000000076693000-memory.dmp

      Filesize

      8KB

    • memory/1992-59-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-61-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-60-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-58-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-64-0x0000000000400000-0x000000000050C000-memory.dmp

      Filesize

      1.0MB

    • memory/1992-65-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-66-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-67-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-68-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-57-0x00000000003A0000-0x00000000003A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-72-0x0000000000400000-0x000000000050C000-memory.dmp

      Filesize

      1.0MB