Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2023, 08:30 UTC

General

  • Target

    Doc.exe

  • Size

    720KB

  • MD5

    6fac1d175f51ebf8890cc785e2eefdaf

  • SHA1

    aa50651bfc4f3c2be45f42dda737ac8f5a42b6f5

  • SHA256

    a94bcff5683c5d1b1a3cead3d8236c98590ba2ea9b9018d4cc5ff9b67f08dc4e

  • SHA512

    ffdedb550a54a943c35a75308d0d6282141d540b3aefd564258a69a84bb20e076564afb89f674648f7723110bf781da80b9a6ab7dc08227ab129870d3ad83971

  • SSDEEP

    12288:XMYnQ3j67SESV1eXl8OhA90G/zoEVEKM3vmVFw3Bzfm8nH9X4OvJq4BTaeec7KEC:XBGpOP9f5nH9IO8IeN9EPOQ+zYe

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Doc.exe
    "C:\Users\Admin\AppData\Local\Temp\Doc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Doc.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe'
      2⤵
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2640
    • C:\Users\Admin\AppData\Local\Temp\Doc.exe
      "C:\Users\Admin\AppData\Local\Temp\Doc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2512-64-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2512-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2512-80-0x0000000073750000-0x0000000073E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-62-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2512-66-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2512-76-0x0000000073750000-0x0000000073E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2512-75-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2512-72-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2512-81-0x00000000022D0000-0x0000000002310000-memory.dmp

    Filesize

    256KB

  • memory/2512-67-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2512-70-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2640-77-0x00000000024D0000-0x0000000002510000-memory.dmp

    Filesize

    256KB

  • memory/2640-57-0x000000006EE80000-0x000000006F42B000-memory.dmp

    Filesize

    5.7MB

  • memory/2640-79-0x000000006EE80000-0x000000006F42B000-memory.dmp

    Filesize

    5.7MB

  • memory/2640-61-0x00000000024D0000-0x0000000002510000-memory.dmp

    Filesize

    256KB

  • memory/2640-60-0x00000000024D0000-0x0000000002510000-memory.dmp

    Filesize

    256KB

  • memory/2640-58-0x000000006EE80000-0x000000006F42B000-memory.dmp

    Filesize

    5.7MB

  • memory/2996-28-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-42-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-52-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-50-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-46-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-44-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-40-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-36-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-32-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-30-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-26-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-24-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-20-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-18-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-54-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-48-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-59-0x0000000000930000-0x0000000000931000-memory.dmp

    Filesize

    4KB

  • memory/2996-56-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-38-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-34-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-0-0x0000000074A50000-0x000000007513E000-memory.dmp

    Filesize

    6.9MB

  • memory/2996-22-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-16-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-14-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-12-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-73-0x0000000074A50000-0x000000007513E000-memory.dmp

    Filesize

    6.9MB

  • memory/2996-10-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-8-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-7-0x00000000009D0000-0x00000000009F3000-memory.dmp

    Filesize

    140KB

  • memory/2996-6-0x00000000009D0000-0x00000000009FA000-memory.dmp

    Filesize

    168KB

  • memory/2996-3-0x0000000000C10000-0x0000000000C50000-memory.dmp

    Filesize

    256KB

  • memory/2996-2-0x00000000045A0000-0x000000000462A000-memory.dmp

    Filesize

    552KB

  • memory/2996-1-0x0000000000D00000-0x0000000000DB8000-memory.dmp

    Filesize

    736KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.