Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 13:30

General

  • Target

    5716f055d179678e84dce8819c3882d4eb3993f002b43a021fe802bc6c9b0bd5.exe

  • Size

    458KB

  • MD5

    9a268a1434319b2a7cfd2bb5d77921bd

  • SHA1

    ae7c5045c6dac9d9bff1da372ff4f0c4ec039b4f

  • SHA256

    5716f055d179678e84dce8819c3882d4eb3993f002b43a021fe802bc6c9b0bd5

  • SHA512

    0f0feffed67ce19514316a5c13bbb73d4b5d80e3b0a3c1b6d69fb8a345ca5fbfb48f9e4639d704c3c27beaf284e0439be48fb18d963424e87eecf146a4536e28

  • SSDEEP

    6144:NtKe6YiDdv3m3mgKHIl7bNINTf4cC05nh+H0VSNmsi14DF32sEr4a8XGh+hmOXkm:NtKe6Zv23YdqMGHGSEV4Dl2sAOXkjS

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5716f055d179678e84dce8819c3882d4eb3993f002b43a021fe802bc6c9b0bd5.exe
    "C:\Users\Admin\AppData\Local\Temp\5716f055d179678e84dce8819c3882d4eb3993f002b43a021fe802bc6c9b0bd5.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Windows\spoolsv.exe
      C:\Windows\spoolsv.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:896

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\spoolsv.exe

    Filesize

    462KB

    MD5

    12b141753055a71d69ae5177a8d7c1fc

    SHA1

    51a542912cc469955329fe0edb8f52c13d4631c7

    SHA256

    e2a1c7e038247c1a09da2bdcf9316e19d252d6dce4bf49b4093bed85931d1449

    SHA512

    45892b66a45b35ebb7638f26cc268b4ed49b78bdb8518273c97abdf066b253de81b2bee17ebde6260dcccf8f6f5b73170cebbede37aeb843ef6e57b6712a5d60

  • memory/896-60-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/896-61-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1208-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1208-59-0x0000000000220000-0x0000000000255000-memory.dmp

    Filesize

    212KB

  • memory/1208-57-0x0000000000220000-0x0000000000255000-memory.dmp

    Filesize

    212KB

  • memory/1208-56-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB