Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/05/2023, 15:51

230522-tasw6shd57 5

22/05/2023, 15:46

230522-s71slshd38 5

Analysis

  • max time kernel
    116s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2023, 15:46

General

  • Target

    G_768916/G_x64_x86_289399.exe

  • Size

    1.3MB

  • MD5

    80b65ccbf91375ed450dff25fc7b60e2

  • SHA1

    cba29644ac48b7d53a90aaa3b000b771574b6995

  • SHA256

    21fce3ca864600ea88548acaeea268c189ae9825acd0e3497f5a6242198f7354

  • SHA512

    060c2d81a08107998599d396d9659ca4f56dc2b93e7622cbc88481488398316283b2121e9c3729370c4fbd525043aaf3f74ba422c0183ec6bd2f7ae834c812f3

  • SSDEEP

    24576:ktdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFtCzi3ZAiSLxenD1op42GbaNDRHq:cqTytRFk6ek2zUZAiSLxenD1op42Gba6

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\G_768916\G_x64_x86_289399.exe
    "C:\Users\Admin\AppData\Local\Temp\G_768916\G_x64_x86_289399.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1996
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1372
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4fc
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1668

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1996-54-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/1996-55-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/1996-56-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/1996-57-0x00000000002D0000-0x00000000002D1000-memory.dmp

      Filesize

      4KB

    • memory/1996-58-0x00000000002D0000-0x00000000002D1000-memory.dmp

      Filesize

      4KB

    • memory/1996-59-0x00000000002D0000-0x00000000002D1000-memory.dmp

      Filesize

      4KB

    • memory/1996-60-0x00000000002E0000-0x00000000002E1000-memory.dmp

      Filesize

      4KB

    • memory/1996-61-0x00000000002E0000-0x00000000002E1000-memory.dmp

      Filesize

      4KB

    • memory/1996-62-0x00000000002E0000-0x00000000002E1000-memory.dmp

      Filesize

      4KB

    • memory/1996-63-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/1996-64-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/1996-65-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/1996-66-0x0000000000300000-0x0000000000301000-memory.dmp

      Filesize

      4KB

    • memory/1996-67-0x0000000000300000-0x0000000000301000-memory.dmp

      Filesize

      4KB

    • memory/1996-68-0x0000000000300000-0x0000000000301000-memory.dmp

      Filesize

      4KB

    • memory/1996-70-0x0000000000310000-0x0000000000311000-memory.dmp

      Filesize

      4KB

    • memory/1996-69-0x0000000000310000-0x0000000000311000-memory.dmp

      Filesize

      4KB

    • memory/1996-71-0x0000000000310000-0x0000000000311000-memory.dmp

      Filesize

      4KB

    • memory/1996-72-0x0000000000320000-0x0000000000321000-memory.dmp

      Filesize

      4KB

    • memory/1996-73-0x0000000000320000-0x0000000000321000-memory.dmp

      Filesize

      4KB

    • memory/1996-74-0x0000000000320000-0x0000000000321000-memory.dmp

      Filesize

      4KB

    • memory/1996-75-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/1996-76-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/1996-77-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/1996-78-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/1996-79-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/1996-80-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/1996-81-0x0000000000350000-0x0000000000351000-memory.dmp

      Filesize

      4KB

    • memory/1996-82-0x0000000000350000-0x0000000000351000-memory.dmp

      Filesize

      4KB

    • memory/1996-83-0x0000000000350000-0x0000000000351000-memory.dmp

      Filesize

      4KB

    • memory/1996-84-0x0000000000370000-0x0000000000371000-memory.dmp

      Filesize

      4KB

    • memory/1996-85-0x0000000000370000-0x0000000000371000-memory.dmp

      Filesize

      4KB

    • memory/1996-86-0x0000000000370000-0x0000000000371000-memory.dmp

      Filesize

      4KB

    • memory/1996-87-0x0000000000380000-0x0000000000381000-memory.dmp

      Filesize

      4KB

    • memory/1996-88-0x0000000000380000-0x0000000000381000-memory.dmp

      Filesize

      4KB

    • memory/1996-89-0x0000000000380000-0x0000000000381000-memory.dmp

      Filesize

      4KB

    • memory/1996-90-0x0000000000390000-0x0000000000391000-memory.dmp

      Filesize

      4KB

    • memory/1996-91-0x0000000000390000-0x0000000000391000-memory.dmp

      Filesize

      4KB

    • memory/1996-92-0x0000000000390000-0x0000000000391000-memory.dmp

      Filesize

      4KB

    • memory/1996-93-0x00000000003A0000-0x00000000003A1000-memory.dmp

      Filesize

      4KB

    • memory/1996-94-0x00000000003A0000-0x00000000003A1000-memory.dmp

      Filesize

      4KB

    • memory/1996-95-0x00000000003A0000-0x00000000003A1000-memory.dmp

      Filesize

      4KB

    • memory/1996-96-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/1996-97-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/1996-98-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/1996-99-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/1996-100-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/1996-101-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/1996-102-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/1996-103-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/1996-104-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/1996-105-0x0000000001FC0000-0x00000000020DA000-memory.dmp

      Filesize

      1.1MB

    • memory/1996-109-0x00000000020E0000-0x0000000002209000-memory.dmp

      Filesize

      1.2MB

    • memory/1996-114-0x00000000020E0000-0x0000000002209000-memory.dmp

      Filesize

      1.2MB

    • memory/1996-115-0x0000000000400000-0x000000000055D000-memory.dmp

      Filesize

      1.4MB

    • memory/1996-116-0x0000000074330000-0x0000000075160000-memory.dmp

      Filesize

      14.2MB

    • memory/1996-119-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB