Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    890s
  • max time network
    893s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    27/03/2023, 18:49

General

  • Target

    Windows.exe

  • Size

    187KB

  • MD5

    17187cb3c7e7ea255dd09640d80dd10c

  • SHA1

    49ea78ac549ac474eeadf926a46b47a1b0253375

  • SHA256

    bc9805f25ccd605e0267a8ec7210274e4a4bbfa0ea2eb9670c22390e2cc28556

  • SHA512

    ee7725b15c686e6162988140f504e16f4222d1a2382a156be6c5f5ae4a453f461915d954093778a415dd583dfc2178465fd1c64349ab629dba478e3b92677a62

  • SSDEEP

    3072:gTKhQsJS1OKynJfaE/uylBzDylgeBKWr680QGS/odFSP0692Y2ElP4kg2YkD:EKhhJS1IJyE/HBXw/KWB0QZ/oQt92Y2W

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Quest Software\PowerGUI\1bd8f6f2-c319-4534-a75f-4e875b9c9f6f\zip.PS1

    Filesize

    1KB

    MD5

    390154311ec34c9f5c69678cbb6f2634

    SHA1

    c7ff4cf5d83b0adb2972a61d56cddf6b6d9adaa4

    SHA256

    8b69f0f689b635af6acc57a455829e4ebbc7a77be11a4e9c194189a26e4c53c7

    SHA512

    901ec1b5db1d4b1c10baea4d6f72ad3fb912d9da8f0dfa98fc8c01e77fb00a71e1cd371fe272b43f84d72ba3caf3ea5940ab7ac91c7d9234a5f94c1f2b13da51

  • memory/1204-64-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/1204-56-0x0000000001E30000-0x0000000001E68000-memory.dmp

    Filesize

    224KB

  • memory/1204-55-0x00000000002E0000-0x00000000002FA000-memory.dmp

    Filesize

    104KB

  • memory/1204-62-0x000000001A810000-0x000000001A844000-memory.dmp

    Filesize

    208KB

  • memory/1204-63-0x000000001BDA0000-0x000000001C082000-memory.dmp

    Filesize

    2.9MB

  • memory/1204-54-0x0000000000310000-0x0000000000346000-memory.dmp

    Filesize

    216KB

  • memory/1204-65-0x000000001A690000-0x000000001A6AC000-memory.dmp

    Filesize

    112KB

  • memory/1204-66-0x000000001B280000-0x000000001B2C8000-memory.dmp

    Filesize

    288KB

  • memory/1204-67-0x0000000001E70000-0x0000000001E78000-memory.dmp

    Filesize

    32KB

  • memory/1204-68-0x000000001B620000-0x000000001B6C6000-memory.dmp

    Filesize

    664KB

  • memory/1204-69-0x000000001B6D0000-0x000000001B71A000-memory.dmp

    Filesize

    296KB

  • memory/1204-70-0x000000001ADD0000-0x000000001ADE6000-memory.dmp

    Filesize

    88KB