Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 11:27

Errors

Reason
Reading agent response: read tcp 10.127.0.1:45662->10.127.0.32:8000: read: connection reset by peer

General

  • Target

    efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe

  • Size

    301KB

  • MD5

    04b1057e2795043a6a7681ac951c6506

  • SHA1

    a174173bc54629f7a9d8972dfc0731c1e7916d3b

  • SHA256

    efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

  • SHA512

    6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f

  • SSDEEP

    6144:eMghXT2rtzWLM4DCAgdCNh4rhJBiWSnG85jI4:e7wyEdCD4rBSnGY

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
    "C:\Users\Admin\AppData\Local\Temp\efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\x2z8.exe
      C:\Users\Admin\AppData\Local\Temp\\x2z8.exe
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:872
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1396

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\fpath.txt

      Filesize

      102B

      MD5

      963a5daddeb4abebe5ac4195b71ca1bd

      SHA1

      cd26eebb37a32c0ce9ef24b9b0b52eb6d9f23567

      SHA256

      4ed801b3b77e4f53f3f6ecdff3547052987272063e0e027d90aaeca3fd44e2d0

      SHA512

      a3631d5cfbf0ebc59d9bdc1ca2f8b088314111a914fa23e81f9e54385a79c12b6b1e2e3bcbb08586416ac39cb06b98df22b90b6fe4f470d581ac7922b6ddaedf

    • C:\Users\Admin\AppData\Local\Temp\x2z8.exe

      Filesize

      301KB

      MD5

      04b1057e2795043a6a7681ac951c6506

      SHA1

      a174173bc54629f7a9d8972dfc0731c1e7916d3b

      SHA256

      efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

      SHA512

      6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f

    • \Users\Admin\AppData\Local\Temp\x2z8.exe

      Filesize

      301KB

      MD5

      04b1057e2795043a6a7681ac951c6506

      SHA1

      a174173bc54629f7a9d8972dfc0731c1e7916d3b

      SHA256

      efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

      SHA512

      6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f

    • \Users\Admin\AppData\Local\Temp\x2z8.exe

      Filesize

      301KB

      MD5

      04b1057e2795043a6a7681ac951c6506

      SHA1

      a174173bc54629f7a9d8972dfc0731c1e7916d3b

      SHA256

      efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

      SHA512

      6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f

    • memory/872-62-0x0000000000330000-0x0000000000333000-memory.dmp

      Filesize

      12KB

    • memory/1016-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

      Filesize

      8KB

    • memory/1396-61-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

      Filesize

      8KB