Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 04:54

General

  • Target

    97811e2ebddd41eaab62c04050437de03fec3c52aced0cb47ee58c3ef004f8da.exe

  • Size

    420KB

  • MD5

    cff2d9555e0639b93f1671ed6a712726

  • SHA1

    62ff7739b29f3a4710b89a23d742cbe3f86ed34b

  • SHA256

    97811e2ebddd41eaab62c04050437de03fec3c52aced0cb47ee58c3ef004f8da

  • SHA512

    90506296081474fd4e347a3779290d3f266508336eb690f57ee4cd26481b457ac68a9b4964cc84e7056b32bd59440d6ada4837d1782cfc363713f1f746de52c6

  • SSDEEP

    12288:SxOoQ86y8Vezlmi3lHbF2MBTad+sp/BK9wb+Ha:Swl86y8qlmi9bF2LdrpJo6O

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables taskbar notifications via registry modification
  • Windows security modification 2 TTPs 8 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97811e2ebddd41eaab62c04050437de03fec3c52aced0cb47ee58c3ef004f8da.exe
    "C:\Users\Admin\AppData\Local\Temp\97811e2ebddd41eaab62c04050437de03fec3c52aced0cb47ee58c3ef004f8da.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:1480

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1480-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

    Filesize

    8KB

  • memory/1480-56-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/1480-55-0x00000000002A0000-0x00000000002A6000-memory.dmp

    Filesize

    24KB

  • memory/1480-57-0x00000000002C0000-0x00000000002C3000-memory.dmp

    Filesize

    12KB

  • memory/1480-58-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB