Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/11/2022, 23:08

General

  • Target

    b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe

  • Size

    815KB

  • MD5

    6e8b468ea35cf4b766bdd8673e0dbae5

  • SHA1

    306c216b2d463d28349f1d82ed055b9c730ab8a3

  • SHA256

    b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4

  • SHA512

    7f9292298c286e8a1fdeef5375a06a0e56785fa16eb67c59f3f5c7b4c77e0f02a36d04fd2bbcd1566a58de8193a9fed742124ddb7b3bff2bb9f52553bf7c864f

  • SSDEEP

    24576:vHnM9Gxn5lf/n0HQIhaGYNt0TK2uIo2ma4:vHK65lfP07haGYNuTKH53

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe
    "C:\Users\Admin\AppData\Local\Temp\b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe"
    1⤵
    • Adds Run key to start application
    • Checks processor information in registry
    PID:1436

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1436-54-0x0000000000400000-0x000000000063D000-memory.dmp

    Filesize

    2.2MB

  • memory/1436-55-0x0000000000400000-0x000000000063D000-memory.dmp

    Filesize

    2.2MB

  • memory/1436-56-0x0000000075601000-0x0000000075603000-memory.dmp

    Filesize

    8KB

  • memory/1436-57-0x0000000000400000-0x000000000063D000-memory.dmp

    Filesize

    2.2MB