Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3fbf60454a...bd.exe

windows7-x64

10

3fbf60454a...bd.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    220s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 10:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3fbf60454aa6b09d1617ca32a07904f48cbe6893c85cff7f08a3920d32924ebd.exe

  • Size

    241KB

  • MD5

    189738e8cffc167c85c54566f188cc7a

  • SHA1

    2987206cf8fb11aa97bb09fadfe6068f6d5edf13

  • SHA256

    3fbf60454aa6b09d1617ca32a07904f48cbe6893c85cff7f08a3920d32924ebd

  • SHA512

    7cca2b14ee292b166a62d842df75601845e2835413495a518556b603d8d11316eb816fedf0bec540c52b160298babb17c0ad74b9d2ab173012f4ad9c21d2a30b

  • SSDEEP

    3072:ydiwIZtYRzQUVXabUuYlT7Milg7HJ4lA6B889C7nco2KiiyZ:ydiwIZt5eao3lMi27ne889Icf

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 16 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 20 IoCs
  • NTFS ADS 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fbf60454aa6b09d1617ca32a07904f48cbe6893c85cff7f08a3920d32924ebd.exe
    "C:\Users\Admin\AppData\Local\Temp\3fbf60454aa6b09d1617ca32a07904f48cbe6893c85cff7f08a3920d32924ebd.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/268-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/268-56-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

    Download

  • memory/268-55-0x00000000005E0000-0x00000000005FF000-memory.dmp

    Filesize

    124KB

    Download

  • memory/464-58-0x00000000000F0000-0x00000000000FC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1244-57-0x0000000002970000-0x000000000297C000-memory.dmp

    Filesize

    48KB

    Download