Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03/12/2022, 13:42
General
-
Target
c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40.exe
-
Size
180KB
-
MD5
558cf03642d1f59d58b2aea6fd4d0848
-
SHA1
270ce62f859508b6339f24ac26111a7bd3c851e6
-
SHA256
c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40
-
SHA512
7f446b9005a4f21d3f3660d99da9499c32d2ea750688752b31c792bf30f97f3a04bdd462e634a2f612324ae8cd4cd9cff55d2242cee3253aade67a99b67f2f2e
-
SSDEEP
3072:ufimO4AYcpO4D2rdUz41Vnkz/XFm7cMW5Mz5OiqdwsnWJ/sLb5mFggyqWBOB80lv:ufiL4AYcp/EQzfXMeBdwsW1s3Mgfq+O6
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Deletes itself 1 IoCs
-
Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40.exe"C:\Users\Admin\AppData\Local\Temp\c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40.exe"2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53899df69c1e78e9a5b26645561aebafa
SHA1912b4724e81ab73a1987ce4f89a4de34a3b9374f
SHA2564ad5975145ab7c4e4c68d004ba319bff74c7482357944378f1bd842d157c4c75
SHA512fd944cae45caa5db4354c68fc176e93523599ec64914b97fab50a5677036dae56a6c1374b870dfb58a8beb2b7bf93d0644dafeea523d9dd55c6831e95f9d1405
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
8KB
-
Filesize
140KB
-
Filesize
236KB
-
Filesize
140KB
-
Filesize
140KB