Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    82s
  • max time network
    196s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 04:36

General

  • Target

    4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe

  • Size

    164KB

  • MD5

    16a4f72a115d2ba72770bbc53dda8d50

  • SHA1

    e8a1167df93b6f5cc40cfa8f78fa14144b8735b1

  • SHA256

    4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b

  • SHA512

    2d2b8a4dceebf0a6576c6b979e30ba476e060e99ffd36a26b8966ec18cc287e099a46db6d39732be52a42432c38de49ca573062e03395abd0ffbd140addbd530

  • SSDEEP

    3072:wJfrOsX6d5/hadTRl6ZghWyZokJZ1dTzcTWyQ9:kqKahadTPOspJZvT

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
    "C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
      C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1204
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1768

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RML7GEO8.txt

    Filesize

    535B

    MD5

    846c9ac1bb9c56d4372b844dfe816258

    SHA1

    d52c770456b35caefed4dfb1102356277d3a72c9

    SHA256

    1ae1dd2016a18b1c9a6a90111dc9c38480878d7cd4398003bc943992d526c69c

    SHA512

    4491efd1bf5212e70d706a4f546f27b8fa3f29b8a593dfc6ebb8cf2831ffa6832d5939bbcad234db32f88fc85d12f8533d0f1ba485b24b9cfb00a23c757e6485

  • memory/1692-88-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-57-0x0000000076411000-0x0000000076413000-memory.dmp

    Filesize

    8KB

  • memory/1692-58-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1692-59-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1692-62-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-64-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-66-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-68-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-70-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-72-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-74-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-76-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-78-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-80-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-82-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-84-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-86-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-110-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-92-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-94-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-96-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-98-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-100-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-102-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-104-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-106-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-108-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-90-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-112-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-116-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-114-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-118-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-120-0x00000000002C0000-0x000000000030E000-memory.dmp

    Filesize

    312KB

  • memory/1692-123-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1692-54-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB