Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    241s
  • max time network
    352s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 04:50

General

  • Target

    2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe

  • Size

    148KB

  • MD5

    6d114c7a21aab94456d8e8d4aef88362

  • SHA1

    1229f292c46ffa1bde2db69227c4e98c2e46ae3a

  • SHA256

    0b577f76b08c5267eb5f2f8596127a28a6eaf5ff2089cff6be0b689f31850124

  • SHA512

    828b656d5eeb4e225af9bc76fad68fd51f5bc6a867450f200e005782231cfd762ceef3d2341aa9e2dcfca9db656637dda71ee6b93083664a36e15f02a0342e03

  • SSDEEP

    3072:5fSj3q4+o/mYSpVygq2xW+rQDuZz4AYOr8Hkv:xSusZSXRY+rBF4AYOr8

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
    "C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
      C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2003~1.BAT"
        3⤵
        • Deletes itself
        PID:1480
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1268
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1220
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1120
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "14940505631944034461-119122327422666176-746627954-1186659599651802995481442006"
        1⤵
          PID:1292

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms2003330.bat

          Filesize

          201B

          MD5

          31f1bad038236cdcb0de649f22b87aac

          SHA1

          438922311d652876658c9bda983f8976bc6f0f8a

          SHA256

          a3483616f687b358fe71c56fef0289bf3a57afc0cc007fed294092c3d32d3557

          SHA512

          179e3a255783be0f092be81905ff827d1ece88f26aa4a4cf338c00df7a8ed5b26bfbb8ee6dae2748c717de86d6d288d2ac820eb4743ed97fa46feeb0128d453d

        • memory/560-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

          Filesize

          8KB

        • memory/560-65-0x0000000000350000-0x0000000000354000-memory.dmp

          Filesize

          16KB

        • memory/1120-79-0x00000000379A0000-0x00000000379B0000-memory.dmp

          Filesize

          64KB

        • memory/1120-92-0x0000000000410000-0x0000000000427000-memory.dmp

          Filesize

          92KB

        • memory/1220-83-0x00000000379A0000-0x00000000379B0000-memory.dmp

          Filesize

          64KB

        • memory/1220-94-0x0000000000120000-0x0000000000137000-memory.dmp

          Filesize

          92KB

        • memory/1268-72-0x0000000002A00000-0x0000000002A17000-memory.dmp

          Filesize

          92KB

        • memory/1268-98-0x0000000002A00000-0x0000000002A17000-memory.dmp

          Filesize

          92KB

        • memory/1268-93-0x0000000002A00000-0x0000000002A17000-memory.dmp

          Filesize

          92KB

        • memory/1268-75-0x00000000379A0000-0x00000000379B0000-memory.dmp

          Filesize

          64KB

        • memory/1292-95-0x0000000000080000-0x0000000000097000-memory.dmp

          Filesize

          92KB

        • memory/1292-91-0x00000000379A0000-0x00000000379B0000-memory.dmp

          Filesize

          64KB

        • memory/1292-90-0x00000000379A0000-0x00000000379B0000-memory.dmp

          Filesize

          64KB

        • memory/1292-96-0x0000000000060000-0x0000000000077000-memory.dmp

          Filesize

          92KB

        • memory/1480-81-0x0000000000140000-0x0000000000154000-memory.dmp

          Filesize

          80KB

        • memory/1868-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1868-74-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1868-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1868-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1868-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1868-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1868-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1868-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB