Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    196s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2022, 10:10 UTC

General

  • Target

    9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665.exe

  • Size

    935KB

  • MD5

    42743536cf940ff1c7d56b11697d6982

  • SHA1

    cee0d5bfdf89af1177f3fecd5c7a24cf53388063

  • SHA256

    9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665

  • SHA512

    5e878c316349ce78ed90d172bb589f561edcdf62f3364ea939184381a8147b3422115e06de30e07855d0256bdd4dc5ee892669852d85db602a8bc5d4fda11800

  • SSDEEP

    12288:p5Yr15f753d5QWIDz/Wz9NCyzHinLipNDJ5eoFb0OZ/WiGaks+HL63S27x4J:pyHv5Z+Wzv7AiBll0OBWi6si9GI

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665.exe
    "C:\Users\Admin\AppData\Local\Temp\9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665.exe
      "C:\Users\Admin\AppData\Local\Temp\9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665.exe" Track="0001001000"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1700

Network

  • flag-unknown
    DNS
    42qfu1tujqw5.3gaxqyim.com
    9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665.exe
    Remote address:
    8.8.8.8:53
    Request
    42qfu1tujqw5.3gaxqyim.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    42qfu1tujqw5.3gaxqyim.com
    dns
    9a88d4e318a91bf07a6237a77f6b992a7cfc496923db8e49145eaa7740b64665.exe
    71 B
    144 B
    1
    1

    DNS Request

    42qfu1tujqw5.3gaxqyim.com

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1700-54-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

  • memory/1700-55-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

  • memory/1700-57-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

  • memory/1700-58-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

  • memory/1700-61-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

  • memory/1700-62-0x0000000075E81000-0x0000000075E83000-memory.dmp

    Filesize

    8KB

  • memory/1700-63-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

  • memory/1700-64-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

  • memory/1700-65-0x0000000000400000-0x00000000004F2000-memory.dmp

    Filesize

    968KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.