Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2023, 20:01

General

  • Target

    NA_NA_319afb31cb4d95exeexe_JC.exe

  • Size

    70KB

  • MD5

    319afb31cb4d95e56b23f85ca9a29473

  • SHA1

    eb965b9a31fe53c9b29e4e49db08c604db6eb52f

  • SHA256

    87111c887d02fd60078310077aa56307ac8041fcec78f5985f2c2e9672c431ff

  • SHA512

    bd089dd07cefdf93f75a9f80468ba87eb15652c520b95db737f016d7d0bb42c505fbac6c8e59b633ee6f58bf8de8965a80c905416252682a707c1d45883f67f3

  • SSDEEP

    1536:0ZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:Ld5BJHMqqDL2/Ovvdr

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NA_NA_319afb31cb4d95exeexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NA_NA_319afb31cb4d95exeexe_JC.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads