Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    204s
  • max time network
    207s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 11:03

General

  • Target

    84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe

  • Size

    162KB

  • MD5

    7474cad685eddfc6aa6b86856fb2448d

  • SHA1

    265f559e5b0d352c94a9727b0079758c79c36787

  • SHA256

    84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a

  • SHA512

    f15ae393fa9a28113709feeeb27459e5b93bc5d90fa62ca62d5a8fbed58dbab8c98647d6bb675602631f2bc01d8bda7b380df773df3ac7282c6fd9ed696a9f41

  • SSDEEP

    3072:OGC4mTElLZ9Ig4T2E52U6OyMNPQTHgnW6A4SlU5Mkm/7p9rzk3qq3T:OWmIlLZOg4B52UNpPtnW5HzjkawT

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 8 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe
    "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • Modifies registry key
        PID:1776
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • Modifies registry key
        PID:1780
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • Modifies registry key
        PID:384
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\gggggg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\gggggg.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:324
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\gggggg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\gggggg.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • Modifies registry key
        PID:824

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2016-57-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2016-58-0x00000000760C1000-0x00000000760C3000-memory.dmp

    Filesize

    8KB

  • memory/2016-67-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB