Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 10:14

General

  • Target

    6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c.exe

  • Size

    30KB

  • MD5

    79bb8c8adf47dbbfb7695bacbaf27351

  • SHA1

    8c1a49bed4298650bcfc3296b88185f2a3f27ac6

  • SHA256

    6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c

  • SHA512

    79095fa52869d12c233faeffebd63ab22f5e381df5aca2032ce4d5441ecc8432d359d0b8407688fc3394f0c4ff130563c2d6f09e8d9957a45f89c2d174da2921

  • SSDEEP

    768:gb3EhwiDVnjNL2K1IfnrzMkg8vUF17HcA1:gb3ESqLh1IzzMkggy17Hc2

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c.exe
    "C:\Users\Admin\AppData\Local\Temp\6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks processor information in registry
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1312
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c.exe"
      2⤵
      • Deletes itself
      PID:1688

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\msvsoh.com

    Filesize

    30KB

    MD5

    79bb8c8adf47dbbfb7695bacbaf27351

    SHA1

    8c1a49bed4298650bcfc3296b88185f2a3f27ac6

    SHA256

    6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c

    SHA512

    79095fa52869d12c233faeffebd63ab22f5e381df5aca2032ce4d5441ecc8432d359d0b8407688fc3394f0c4ff130563c2d6f09e8d9957a45f89c2d174da2921

  • C:\Windows\svchost.exe

    Filesize

    30KB

    MD5

    79bb8c8adf47dbbfb7695bacbaf27351

    SHA1

    8c1a49bed4298650bcfc3296b88185f2a3f27ac6

    SHA256

    6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c

    SHA512

    79095fa52869d12c233faeffebd63ab22f5e381df5aca2032ce4d5441ecc8432d359d0b8407688fc3394f0c4ff130563c2d6f09e8d9957a45f89c2d174da2921

  • C:\Windows\svchost.exe

    Filesize

    30KB

    MD5

    79bb8c8adf47dbbfb7695bacbaf27351

    SHA1

    8c1a49bed4298650bcfc3296b88185f2a3f27ac6

    SHA256

    6fa9d878b5cdc35ac32ad7a11af0041a38bd83c3086ffadb22d02516b7a7f59c

    SHA512

    79095fa52869d12c233faeffebd63ab22f5e381df5aca2032ce4d5441ecc8432d359d0b8407688fc3394f0c4ff130563c2d6f09e8d9957a45f89c2d174da2921

  • memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

    Filesize

    8KB

  • memory/620-55-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/620-62-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1312-63-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB