Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    175s
  • max time network
    194s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 05:01

General

  • Target

    c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e.exe

  • Size

    281KB

  • MD5

    c480f54f732054b056ab3f58b2ac8849

  • SHA1

    7d6dcdd28f4d81accabdbf5b47b89b6466066404

  • SHA256

    c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e

  • SHA512

    3d179f7a16b172b3fd39bb1895880e94853805e7d36ca251539016e22f82877b1e0cfc780f73149c545422230fc4cce76242371afb7b0f9fff8855574c48e770

  • SSDEEP

    6144:CAjYIKd4yigl6vffQGe1gGoSFInOl4Dtb73:C6XdffQaFVn+w3

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e.exe
    "C:\Users\Admin\AppData\Local\Temp\c9c35621d911d80245e8f0d43cdfeb80da0301fac05faccacadab7a53e5b975e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1688

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

    Filesize

    8KB

  • memory/1688-55-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/1688-56-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/1688-57-0x0000000002370000-0x0000000002422000-memory.dmp

    Filesize

    712KB

  • memory/1688-59-0x0000000002370000-0x0000000002422000-memory.dmp

    Filesize

    712KB

  • memory/1688-58-0x0000000002370000-0x0000000002422000-memory.dmp

    Filesize

    712KB

  • memory/1688-61-0x0000000002370000-0x0000000002422000-memory.dmp

    Filesize

    712KB

  • memory/1688-62-0x0000000002370000-0x0000000002422000-memory.dmp

    Filesize

    712KB

  • memory/1688-64-0x0000000002370000-0x0000000002422000-memory.dmp

    Filesize

    712KB

  • memory/1688-65-0x0000000002530000-0x00000000025E8000-memory.dmp

    Filesize

    736KB

  • memory/1688-66-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/1688-67-0x0000000002530000-0x00000000025E8000-memory.dmp

    Filesize

    736KB