Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2023, 06:37

General

  • Target

    b3b0faf2f8ad5b902137dfdbfb185c45c3637d139af45c50ef6fdcb09073bb03.exe

  • Size

    1.6MB

  • MD5

    24860bd8364aef9a3be5c26910f51b1e

  • SHA1

    05819ca983452b9795fdbc21274720c7355d89e6

  • SHA256

    b3b0faf2f8ad5b902137dfdbfb185c45c3637d139af45c50ef6fdcb09073bb03

  • SHA512

    353a724bf9d7f0c62152db8060f6ad03f72cceeb9230dc7e514f2a2ab3ea0fd61c997c44084d0a95d6bb2b4aee078c577c82594a09589320b522c3dfe578c359

  • SSDEEP

    49152:XgGWQaAAZ4HEYKVxH1XvK3r6EQG3ad2VbFXT5XQ1:Yd4EYCXvK3WBH2jD5A1

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3b0faf2f8ad5b902137dfdbfb185c45c3637d139af45c50ef6fdcb09073bb03.exe
    "C:\Users\Admin\AppData\Local\Temp\b3b0faf2f8ad5b902137dfdbfb185c45c3637d139af45c50ef6fdcb09073bb03.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c53e2a8370c6af15ed12e6a6bf35fd3c

    SHA1

    69e0cd393f9175af4e0603d128674ac51de3c9cc

    SHA256

    5b9f53d85f5ca576a3946d171ea24013fa5118094978bdeec42328a2523f715d

    SHA512

    c40391b77976a82622f81b698a0f531cbfb944dff9e5faac315327a1dc55c83000b68ddaba00e3f544220ea777a928e966eb8f3dcc290100312465c9eb15f6a7

  • C:\Users\Admin\AppData\Local\Temp\Cab54C6.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar5527.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • memory/2160-0-0x0000000000460000-0x0000000000494000-memory.dmp

    Filesize

    208KB

  • memory/2160-2-0x000000001AEC0000-0x000000001AF40000-memory.dmp

    Filesize

    512KB

  • memory/2160-1-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

    Filesize

    9.9MB

  • memory/2160-6-0x000000001AEC0000-0x000000001AF40000-memory.dmp

    Filesize

    512KB

  • memory/2160-3-0x000000001AEC0000-0x000000001AF40000-memory.dmp

    Filesize

    512KB

  • memory/2160-4-0x000000001AEC0000-0x000000001AF40000-memory.dmp

    Filesize

    512KB

  • memory/2160-53-0x000000001AEC0000-0x000000001AF40000-memory.dmp

    Filesize

    512KB

  • memory/2160-5-0x0000000000490000-0x000000000049A000-memory.dmp

    Filesize

    40KB

  • memory/2160-91-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

    Filesize

    9.9MB

  • memory/2160-92-0x0000000000490000-0x000000000049A000-memory.dmp

    Filesize

    40KB

  • memory/2160-93-0x0000000000490000-0x000000000049A000-memory.dmp

    Filesize

    40KB