Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1590s
  • max time network
    1735s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2023, 00:02

General

  • Target

    GalacticFortress.exe

  • Size

    651KB

  • MD5

    b746ec336a45656a92d61da9c3816b05

  • SHA1

    28f48c6dcccedd34f4b7dca393a0aba446f0d3f4

  • SHA256

    4c48c5a35cf17c0fb3c05864681f7ed59728b7a51cd87940e92136e99ef4ac13

  • SHA512

    a33b11f03ab250096f427824b3c5bfe0a384dfd1aca7f25b487d90a3b189879b3d08133d5007c2f30a1394fc2695bae591f38de0905ae96e6ef16141ae183b72

  • SSDEEP

    3072:JQJ/VdFgIW9mYucJ/OD8JlsI90TIC7G2E1:a/7FG9mpcJ/OD8h/

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GalacticFortress.exe
    "C:\Users\Admin\AppData\Local\Temp\GalacticFortress.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
      "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 1036 1576960
      2⤵
        PID:2036
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x57c
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1404

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1036-68-0x000007FFFFEC0000-0x000007FFFFED0000-memory.dmp

      Filesize

      64KB

    • memory/1036-85-0x000007FFFFEB0000-0x000007FFFFEC0000-memory.dmp

      Filesize

      64KB