Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2022, 18:09

General

  • Target

    2014_11transaktions_pdf_000093378_2014_0000919_11_v_00028836_n_827100007.exe

  • Size

    160KB

  • MD5

    3d0d526add38e6695a2608b0bdd3633a

  • SHA1

    b65b13ef23d183748ab922301ae519045302fd8b

  • SHA256

    0fb33ea57ccd832a3fd8d26ad9dfa97fdd45c37a51b602a182438a17e374eb0e

  • SHA512

    c601b0912d76e9417cb3a33a5e67e470325966ed8ce176b2e14095d393146b2f96c448c9fcf7e41209653f02af062a42db78a401675beed7771b614d2611d738

  • SSDEEP

    3072:Y7tIMOClxoixT3+WsY6AYptmiOANwZD67SHGV/X12sihrjJ89GuzxwM8:wtIAlx7T3VsYU2qUmDX4DQ/xD8

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\2014_11transaktions_pdf_000093378_2014_0000919_11_v_00028836_n_827100007.exe
      "C:\Users\Admin\AppData\Local\Temp\2014_11transaktions_pdf_000093378_2014_0000919_11_v_00028836_n_827100007.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Users\Admin\AppData\Local\Temp\2014_11transaktions_pdf_000093378_2014_0000919_11_v_00028836_n_827100007.exe
        C:\Users\Admin\AppData\Local\Temp\2014_11transaktions_pdf_000093378_2014_0000919_11_v_00028836_n_827100007.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4245~1.BAT"
          4⤵
          • Deletes itself
          PID:1516
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1184
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1128
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "115323065322713390-1977309385194970933416910796253507951431581118628-267813925"
        1⤵
          PID:1612

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms4245398.bat

          Filesize

          201B

          MD5

          1802eb7603a75f3ddd1c09b212ae9e32

          SHA1

          521ca6849fb8dc36b14d9a251ff0cf9cffc2c206

          SHA256

          e3af5f9783ff36af08d2ca3070a374d0e055cdd1941b329980a0e77a27f7c7b1

          SHA512

          bc444426599c39a56930782a716d9634061dd0e965476d501bb1ebf01ed2bbe16ace9508a17679fd073878542635fba53e125267c15370e9c8356e07a403fca1

        • memory/864-74-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/864-56-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/864-58-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/864-60-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/864-62-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/864-67-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/864-55-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/864-63-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1128-92-0x0000000001E60000-0x0000000001E77000-memory.dmp

          Filesize

          92KB

        • memory/1128-90-0x0000000037890000-0x00000000378A0000-memory.dmp

          Filesize

          64KB

        • memory/1128-96-0x0000000000260000-0x0000000000277000-memory.dmp

          Filesize

          92KB

        • memory/1128-88-0x0000000037890000-0x00000000378A0000-memory.dmp

          Filesize

          64KB

        • memory/1184-89-0x0000000037890000-0x00000000378A0000-memory.dmp

          Filesize

          64KB

        • memory/1184-95-0x0000000000120000-0x0000000000137000-memory.dmp

          Filesize

          92KB

        • memory/1212-94-0x00000000021C0000-0x00000000021D7000-memory.dmp

          Filesize

          92KB

        • memory/1212-72-0x00000000021C0000-0x00000000021D7000-memory.dmp

          Filesize

          92KB

        • memory/1212-75-0x0000000037890000-0x00000000378A0000-memory.dmp

          Filesize

          64KB

        • memory/1516-82-0x00000000000F0000-0x0000000000104000-memory.dmp

          Filesize

          80KB

        • memory/1612-93-0x00000000001B0000-0x00000000001C7000-memory.dmp

          Filesize

          92KB

        • memory/1752-65-0x0000000000270000-0x0000000000274000-memory.dmp

          Filesize

          16KB

        • memory/1752-54-0x0000000076261000-0x0000000076263000-memory.dmp

          Filesize

          8KB