Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    40s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 15:44

General

  • Target

    777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb.exe

  • Size

    1.1MB

  • MD5

    5deb72103587faa2479065d6e2dd3460

  • SHA1

    04c71086f3e69e73ab3c3f3e013d422884656e14

  • SHA256

    777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb

  • SHA512

    71aa67992fc2ed0e7775a24e4165eb3e243eac86f8a0186c3928594b2d9b94dda6a4d6058c2940df38e08c4e05092a9fd9c026aa5719f80d9509dbea77bb95fb

  • SSDEEP

    12288:UnwuWGyqJEjVAFR9QCIAAKK2GhouKx2RnglGAEqnjFGRueuFAB6hSFCG+5NNpDQL:mm8QCIN/LKxcIEDRueMEox9pDQKC

Score
9/10

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb.exe
    "C:\Users\Admin\AppData\Local\Temp\777f9e96d85a965f427a650ad6897df75eab63ecd8acb3b84070ce2c65d803cb.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1228-54-0x0000000075091000-0x0000000075093000-memory.dmp

    Filesize

    8KB

  • memory/1228-55-0x00000000002E0000-0x00000000003D6000-memory.dmp

    Filesize

    984KB

  • memory/1228-56-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/1228-57-0x00000000002E0000-0x00000000003D6000-memory.dmp

    Filesize

    984KB

  • memory/1228-58-0x00000000002E0000-0x00000000002E5000-memory.dmp

    Filesize

    20KB

  • memory/1228-59-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

  • memory/1228-61-0x00000000002E0000-0x00000000002E5000-memory.dmp

    Filesize

    20KB

  • memory/1228-60-0x00000000002E0000-0x00000000003D6000-memory.dmp

    Filesize

    984KB