Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/06/2023, 21:00

230603-ztkb2aae9t 8

03/06/2023, 20:57

230603-zrv1raaa87 8

Analysis

  • max time kernel
    28s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2023, 21:00

General

  • Target

    TGX.exe

  • Size

    686KB

  • MD5

    44a4e3d019880eab7d1cc7fe50400227

  • SHA1

    c0e60962bf5dcd8d47bfa6aec07917a13fed86bf

  • SHA256

    91ecd3092e58361a48a096d844f1846f5e6ca76b5091e9499ed3b4c3fbe28a3d

  • SHA512

    622a6ad80c6b357e46e3428311584584d3329d69f46b7c44c31c1083f3fbe9e859da5259784600d5260dfa3ea836fbb02c80c8070e13ba7936d1b273c2c17e38

  • SSDEEP

    12288:21IytQVxkI3A9VWcTkRe4n5yxmrKLR/mYbkDo44NTPqyiRr1JY1ay7nmGQ6:EZqJyxmrKLVmYdqr1Swy7ni6

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TGX.exe
    "C:\Users\Admin\AppData\Local\Temp\TGX.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1720
      2⤵
      • Program crash
      PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2032-54-0x0000000000C20000-0x0000000000CD0000-memory.dmp

    Filesize

    704KB

  • memory/2032-55-0x00000000023B0000-0x00000000023F0000-memory.dmp

    Filesize

    256KB

  • memory/2032-56-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2032-57-0x0000000004930000-0x0000000004A76000-memory.dmp

    Filesize

    1.3MB

  • memory/2032-58-0x00000000021D0000-0x00000000021DA000-memory.dmp

    Filesize

    40KB

  • memory/2032-59-0x00000000021D0000-0x00000000021DA000-memory.dmp

    Filesize

    40KB

  • memory/2032-60-0x00000000023B0000-0x00000000023F0000-memory.dmp

    Filesize

    256KB

  • memory/2032-61-0x00000000021D0000-0x00000000021DA000-memory.dmp

    Filesize

    40KB

  • memory/2032-62-0x00000000021D0000-0x00000000021DA000-memory.dmp

    Filesize

    40KB