Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    17s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19/05/2023, 21:13

Errors

Reason
Machine shutdown

General

  • Target

    obabma.jpg

  • Size

    191KB

  • MD5

    992fc3e7a36d29ba14254c3f05d2e649

  • SHA1

    a80c4610659b747aee95ee6c4c22d28b768710d7

  • SHA256

    4f11e355a779546dfc53e15abb176a51b44e408d9f097dd6a90c0e2122fcf3bf

  • SHA512

    6d83a3d0454789ff9e6c5711ab2a8b5a41fb7acf29a2bd70f6e65a6700d6a69a9bda79166e855259aad863b0a2aeadad7dabb5d975f03fa3916ce031d93cd842

  • SSDEEP

    3072:mQ0oK8mIc5T/sXOcg6e+EmDFYl0/JqEBHRpUdMrXCK0K6wTWKNDEUXUFeJokBMn3:mPohc5T0XORIYm/JdxSb3wT1EYUFCXq3

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\obabma.jpg
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2040
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/764-55-0x0000000002800000-0x0000000002801000-memory.dmp

    Filesize

    4KB

  • memory/2040-54-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

    Filesize

    4KB

  • memory/2040-56-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

    Filesize

    4KB