Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 14:11

General

  • Target

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe

  • Size

    288KB

  • MD5

    eb2aefd8d89c2b798efda3c000674954

  • SHA1

    f623167734cf586ecd3e0b0a038921aa4b76c9ae

  • SHA256

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3

  • SHA512

    47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f

  • SSDEEP

    6144:+4RKN7o1hYYZyr+fBs6ywacA5AcrbGsKF4WYBCtl8gIHuEBbgDxrR95lumbwxtvp:+4v2VyDq+XAyTFR

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe
    "C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe
      "C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe
        "C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:668
        • C:\Users\Admin\AppData\Roaming\msconfig11.exe
          "C:\Users\Admin\AppData\Roaming\msconfig11.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:268
          • C:\Users\Admin\AppData\Roaming\msconfig11.exe
            "C:\Users\Admin\AppData\Roaming\msconfig11.exe"
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Users\Admin\AppData\Roaming\msconfig11.exe
              "C:\Users\Admin\AppData\Roaming\msconfig11.exe"
              6⤵
              • Modifies firewall policy service
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\msconfig11.exe

    Filesize

    288KB

    MD5

    eb2aefd8d89c2b798efda3c000674954

    SHA1

    f623167734cf586ecd3e0b0a038921aa4b76c9ae

    SHA256

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3

    SHA512

    47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f

  • C:\Users\Admin\AppData\Roaming\msconfig11.exe

    Filesize

    288KB

    MD5

    eb2aefd8d89c2b798efda3c000674954

    SHA1

    f623167734cf586ecd3e0b0a038921aa4b76c9ae

    SHA256

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3

    SHA512

    47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f

  • C:\Users\Admin\AppData\Roaming\msconfig11.exe

    Filesize

    288KB

    MD5

    eb2aefd8d89c2b798efda3c000674954

    SHA1

    f623167734cf586ecd3e0b0a038921aa4b76c9ae

    SHA256

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3

    SHA512

    47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f

  • C:\Users\Admin\AppData\Roaming\msconfig11.exe

    Filesize

    288KB

    MD5

    eb2aefd8d89c2b798efda3c000674954

    SHA1

    f623167734cf586ecd3e0b0a038921aa4b76c9ae

    SHA256

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3

    SHA512

    47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f

  • \Users\Admin\AppData\Roaming\msconfig11.exe

    Filesize

    288KB

    MD5

    eb2aefd8d89c2b798efda3c000674954

    SHA1

    f623167734cf586ecd3e0b0a038921aa4b76c9ae

    SHA256

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3

    SHA512

    47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f

  • \Users\Admin\AppData\Roaming\msconfig11.exe

    Filesize

    288KB

    MD5

    eb2aefd8d89c2b798efda3c000674954

    SHA1

    f623167734cf586ecd3e0b0a038921aa4b76c9ae

    SHA256

    fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3

    SHA512

    47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f

  • memory/668-78-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/668-71-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/668-68-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/668-67-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/668-70-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/668-77-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB

  • memory/668-72-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/668-79-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/668-73-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/884-114-0x0000000000230000-0x0000000000239000-memory.dmp

    Filesize

    36KB

  • memory/884-115-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/948-56-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/948-76-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/948-62-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/948-59-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/948-57-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1700-109-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB