Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2023, 21:18

General

  • Target

    bc2d002a880677ba93463f13725d55d03427b7e84ccd4b8daef424bf533b993a.exe

  • Size

    12.9MB

  • MD5

    3b291a42dcaf090beba942307ca8b970

  • SHA1

    09619eb8b9407f01d72ada16d17849c560cf8aae

  • SHA256

    bc2d002a880677ba93463f13725d55d03427b7e84ccd4b8daef424bf533b993a

  • SHA512

    584cf1f4cc0e9933a2c0f73e66e2b036b59b7186c2d9099619d5e1cb75a6992fb0979205f4e16762a4358f6c2828392a0f17f52a468caba221e129c7711612bd

  • SSDEEP

    196608:QEbzn1yKTsy0LScY2q6mHwqrfYIj7SEZI3OFtk1+gM2ukFmorPkUUnBgLlvNhf:Hroxe/HwaAISEZIogM2bLPk1W5VN

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc2d002a880677ba93463f13725d55d03427b7e84ccd4b8daef424bf533b993a.exe
    "C:\Users\Admin\AppData\Local\Temp\bc2d002a880677ba93463f13725d55d03427b7e84ccd4b8daef424bf533b993a.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\96d012be3be7d8333b162802240d96a2.ini

    Filesize

    1KB

    MD5

    0f174a34854042fb7da145de2c45b1f1

    SHA1

    49980acdbdd3a0e91fa2a9be86ba081a83d902e2

    SHA256

    ff767955d5a7b7ab8149956bfe7bdef938fb1c9af5195a7415a3561d1c92c9e1

    SHA512

    4e843ce2e6383a4fe285bc91574575b23419dc501042cc0836994e9dbb2735d55a076c1a6a4a318bafbd18bfaa7667efdbb717b3b1afaf0f84bb88523b1d425c

  • C:\Users\Admin\AppData\Local\Temp\96d012be3be7d8333b162802240d96a2A.ini

    Filesize

    1KB

    MD5

    440d1013b7d901c6d36bdda83ecf6d97

    SHA1

    9869369bd47c7903c01d9d1b4c8d2acb483a7936

    SHA256

    38a4e0c17fa16216c81c4ba0a9cec6708c728ca1215e0b6244bd4129d519b6c8

    SHA512

    014fd73d28e6533735aada7ed03a31eb2d15ab0d9d2629b42f5e72b252c1c5cf95df2bfba93892b2e5abb90ff7915b5f1767fef212974a58fbb036b99de33c39

  • C:\Users\Admin\AppData\Local\Temp\CabF9C.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar11F0.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Local\Temp\bc2d002a880677ba93463f13725d55d03427b7e84ccd4b8daef424bf533b993a.exepack.tmp

    Filesize

    2KB

    MD5

    3d17e48ad9d157f02c8280420e791fda

    SHA1

    32d3fd64b69205052365127a298e7141a07140e5

    SHA256

    b68f3946eb230a1cb7e6cbf8b2e8bf86f6d2ac79612cfaba64b7b6f22c0f9b65

    SHA512

    c062d41054728e91a580783ddd165b26c5a3d91389f050fbdfd59bf6047b9f73de12776dc115d9a6a0b4d7a5fbb3c099cf28cf983c7171df490c340cf7239b38

  • memory/2392-457-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-461-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-400-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-410-0x00000000003E0000-0x00000000003E3000-memory.dmp

    Filesize

    12KB

  • memory/2392-56-0x0000000050000000-0x0000000050109000-memory.dmp

    Filesize

    1.0MB

  • memory/2392-55-0x00000000003E0000-0x00000000003E3000-memory.dmp

    Filesize

    12KB

  • memory/2392-420-0x0000000050000000-0x0000000050109000-memory.dmp

    Filesize

    1.0MB

  • memory/2392-54-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-458-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-459-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-460-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-391-0x0000000003850000-0x0000000003860000-memory.dmp

    Filesize

    64KB

  • memory/2392-465-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-466-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-467-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-468-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-469-0x0000000003850000-0x0000000003860000-memory.dmp

    Filesize

    64KB

  • memory/2392-470-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-471-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-472-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-473-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB

  • memory/2392-474-0x0000000000400000-0x0000000001DA1000-memory.dmp

    Filesize

    25.6MB