Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    39s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 15:14

General

  • Target

    b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe

  • Size

    54KB

  • MD5

    a2b3ecbc0e24649389143edda113ff9a

  • SHA1

    130ef89435bc2c7c8cbe21211d9bbaa108d67ffa

  • SHA256

    b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed

  • SHA512

    630d700769aa2d3b56143fd7fca9957d73eb1e0f56078967fa066a4d85961b0939bc5b35f7bd7972ff1fc1862069f6d198ea2ec284c9a71f0e8bd86a880710e9

  • SSDEEP

    1536:3nLvs+iVqGJi+X9cgydqfTP7q0qPYNIFJyW:3DmsAi+X9byrpV3yW

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe
    "C:\Users\Admin\AppData\Local\Temp\b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{958C8EE3-16D5-D9AA-67C0-4045623214AA}" /f
      2⤵
        PID:1964
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B03E46~1.EXE > nul
        2⤵
        • Deletes itself
        PID:1700

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1144-54-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/1144-56-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

      Filesize

      8KB

    • memory/1144-58-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB