Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 00:11

General

  • Target

    a1f91a2a440c70f319930d870e1ff2a469df9b86753b1666e9a08695cec0b648.exe

  • Size

    327KB

  • MD5

    947e41ee529a41dae4a13dbe0b14c75f

  • SHA1

    e26bdebaff268424f7ab64df4dd608de385c410c

  • SHA256

    a1f91a2a440c70f319930d870e1ff2a469df9b86753b1666e9a08695cec0b648

  • SHA512

    5c5007aa489fc22f21d18385742e8ddfc7dc46670647a779044b93d6aa257b2bee6e9357327c7397e088460d76cb02674d53f422b5aea3bbdc444fc72ca1badf

  • SSDEEP

    6144:83MVk9U3mgJukP+2Ucpn5qAKP1UkrMhcOIk8kRL5YejF:hCU0aZLLqEkrMhct8OUF

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1f91a2a440c70f319930d870e1ff2a469df9b86753b1666e9a08695cec0b648.exe
    "C:\Users\Admin\AppData\Local\Temp\a1f91a2a440c70f319930d870e1ff2a469df9b86753b1666e9a08695cec0b648.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1100

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1100-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

    Filesize

    8KB

  • memory/1100-55-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/1100-56-0x0000000000400000-0x00000000004EF000-memory.dmp

    Filesize

    956KB

  • memory/1100-57-0x0000000001F20000-0x0000000001FD2000-memory.dmp

    Filesize

    712KB

  • memory/1100-59-0x0000000001F20000-0x0000000001FD2000-memory.dmp

    Filesize

    712KB

  • memory/1100-58-0x0000000001F20000-0x0000000001FD2000-memory.dmp

    Filesize

    712KB

  • memory/1100-61-0x0000000001F20000-0x0000000001FD2000-memory.dmp

    Filesize

    712KB

  • memory/1100-62-0x0000000001F20000-0x0000000001FD2000-memory.dmp

    Filesize

    712KB

  • memory/1100-64-0x0000000001F20000-0x0000000001FD2000-memory.dmp

    Filesize

    712KB

  • memory/1100-65-0x00000000022D0000-0x0000000002388000-memory.dmp

    Filesize

    736KB

  • memory/1100-66-0x00000000022D0000-0x0000000002388000-memory.dmp

    Filesize

    736KB