Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    55s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21/03/2023, 16:26

General

  • Target

    QUOTATION _RFQ# 1043999.exe

  • Size

    1.1MB

  • MD5

    e434e422d6bb9bc02f9a4be0b1c41d1b

  • SHA1

    af7347b789fb43b26a83f4864e50eedf7f62095e

  • SHA256

    c269b1931db163462343d0ecd8ef501e35e4da91c91f1464c8d526ef07a041bd

  • SHA512

    72ffed26dfa5617a70852e88d8058d6adebcbd771bc3f0102f8fcf9bdddcac2264b37d07b5fd4790c177ad87f81fce0253ff9fc85c22f8034c066e66df657552

  • SSDEEP

    24576:nVlj9vY9URDvRtWBQDtty/ziBgqMSAqzQYkYJrrzZL:nVB9g9YDptWuryduIA1L

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
      "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
      2⤵
        PID:908
      • C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
        "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
        2⤵
          PID:1500
        • C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
          "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
          2⤵
            PID:1652
          • C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
            "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
            2⤵
              PID:600
            • C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe
              "C:\Users\Admin\AppData\Local\Temp\QUOTATION _RFQ# 1043999.exe"
              2⤵
                PID:320

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1320-54-0x00000000003C0000-0x00000000004D8000-memory.dmp

              Filesize

              1.1MB

            • memory/1320-55-0x0000000004C50000-0x0000000004C90000-memory.dmp

              Filesize

              256KB

            • memory/1320-56-0x0000000000790000-0x00000000007A2000-memory.dmp

              Filesize

              72KB

            • memory/1320-57-0x0000000004C50000-0x0000000004C90000-memory.dmp

              Filesize

              256KB

            • memory/1320-58-0x00000000007A0000-0x00000000007AC000-memory.dmp

              Filesize

              48KB

            • memory/1320-59-0x0000000005740000-0x000000000582A000-memory.dmp

              Filesize

              936KB

            • memory/1320-60-0x0000000004DA0000-0x0000000004E16000-memory.dmp

              Filesize

              472KB