Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
27/11/2022, 15:10 UTC
General
-
Target
3f1709224c113a36e8b3a7d4bb24b9ec35b762d94a8218f8f4c0b82c9ed51cbb.exe
-
Size
9.2MB
-
MD5
3685bf179182825f79569a5ed730f586
-
SHA1
db87834bd9183183085e2ec1880729a07b88059e
-
SHA256
3f1709224c113a36e8b3a7d4bb24b9ec35b762d94a8218f8f4c0b82c9ed51cbb
-
SHA512
e5fccab9d05abe8f6838f582bc5326af15c9c12353a9062c47d85f6b76b2ee24e195154c1dbe622919a92414ddb933af16f3436d42575a6e892aa39d3f0150a3
-
SSDEEP
196608:sVOMAQtJHQbegJtU6ZPYW251neAjnqjIxycT7B:kASQyRwYW239nqjMlV
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f1709224c113a36e8b3a7d4bb24b9ec35b762d94a8218f8f4c0b82c9ed51cbb.exe"C:\Users\Admin\AppData\Local\Temp\3f1709224c113a36e8b3a7d4bb24b9ec35b762d94a8218f8f4c0b82c9ed51cbb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
-
DNSwww.wg50.comRemote address:8.8.8.8:53Requestwww.wg50.comIN AResponse -
DNSwww.wg50.comRemote address:8.8.8.8:53Requestwww.wg50.comIN AResponse
-
DNSwww.wg50.comRemote address:8.8.8.8:53Requestwww.wg50.comIN AResponse
-
DNSwww1.fy911.comRemote address:8.8.8.8:53Requestwww1.fy911.comIN AResponsewww1.fy911.comIN A104.206.87.22
-
DNSwww.wg50.comRemote address:8.8.8.8:53Requestwww.wg50.comIN AResponse
-
DNSwww.wg50.comRemote address:8.8.8.8:53Requestwww.wg50.comIN AResponse
-
DNSwww.wg50.comRemote address:8.8.8.8:53Requestwww.wg50.comIN AResponse
-
104.206.87.22:88www1.fy911.com
-
104.206.87.22:88www1.fy911.com
-
8.8.8.8:53www.wg50.comdns
DNS Request
www.wg50.com
DNS Request
www.wg50.com
DNS Request
www.wg50.com
-
8.8.8.8:53www1.fy911.comdns
DNS Request
www1.fy911.com
DNS Response
104.206.87.22
-
8.8.8.8:53www.wg50.comdns
DNS Request
www.wg50.com
DNS Request
www.wg50.com
DNS Request
www.wg50.com
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
284KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
9.2MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
1024KB
-
Filesize
1.1MB
-
Filesize
1.0MB
-
Filesize
644KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
9.2MB