Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    86s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 13:39

General

  • Target

    902f7a7ca9bd4f3ecb8aeb30a7f223bbc4e15756b6650d0f6e5737b1e85fb35f.exe

  • Size

    1.0MB

  • MD5

    bb0ea16457b6a7699922058096598d8a

  • SHA1

    bbb8d115c9d98f00ed351956a7ea2092a9e5ec9f

  • SHA256

    902f7a7ca9bd4f3ecb8aeb30a7f223bbc4e15756b6650d0f6e5737b1e85fb35f

  • SHA512

    80db9a55fa46c7e37d8c4734fe23b1349f3e3e5ca0ebb638624eee21d85020ab865109ca6b67bb099129f47d87a88ec4aaf9c10184d2ec3dcbb0f69dc3e4028a

  • SSDEEP

    24576:Q0BfZ15Scs4mUj79qPiqn7yauT/asgd0tp8Al:Q0guUuT/asgUh

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\902f7a7ca9bd4f3ecb8aeb30a7f223bbc4e15756b6650d0f6e5737b1e85fb35f.exe
    "C:\Users\Admin\AppData\Local\Temp\902f7a7ca9bd4f3ecb8aeb30a7f223bbc4e15756b6650d0f6e5737b1e85fb35f.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\902f7a7ca9bd4f3ecb8aeb30a7f223bbc4e15756b6650d0f6e5737b1e85fb35f.exe
      "C:\Users\Admin\AppData\Local\Temp\902f7a7ca9bd4f3ecb8aeb30a7f223bbc4e15756b6650d0f6e5737b1e85fb35f.exe" Track="0001001000"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:544

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/544-54-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-55-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-57-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-59-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-61-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-63-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-65-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-68-0x0000000075991000-0x0000000075993000-memory.dmp

    Filesize

    8KB

  • memory/544-69-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-70-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-71-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/544-72-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB