Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
05/10/2023, 17:48
General
-
Target
ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe
-
Size
274KB
-
MD5
39bd4507e22dd521757969971a05a33b
-
SHA1
1183e86495850692d5f012eb0181e9fc0acf2eae
-
SHA256
ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a
-
SHA512
b926ee636e3f85d170fec75549faf615f6218e4d2c3e87e38faa5707a020ee69b821a2557d88860d5f9604c9580d0cb4d155a5e986795a9488960244be5b5996
-
SSDEEP
6144:bbTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:bPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 9 IoCs
-
Deletes itself 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 26 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 59 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe"C:\Users\Admin\AppData\Local\Temp\ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe"2⤵
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\ed474e7b1ad893ca2698eb2644e8d4184a4e429b98eeff59d04f1950f502f85a.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD520a6c9ee4e457267adf58889fb1dd617
SHA16cb2beebd527ed5f77a13228f93eec7af88b822e
SHA25645be093d2a1d3beb6db08a3e71cfba063736edd92a18302cf5f6fefc13bfab3b
SHA512d4ff64a5b7af4119c739e605a1dc7710175090ae8363b2e73976bea8555e07e63380255a534b3389e61a3e7e6a1cc67b969e2f912d6978e45d39243455114e28
-
Filesize
1KB
MD52a61a3d0f5beb7727441b0e010c30d7d
SHA12dc8b67f13196d3a658d79c9c575bf0a0b75da15
SHA2568f97e861acd3950fde5361476dd989039edff251a00b7de4df84cbacfa629a0d
SHA512d29a461cd7c4746015684c9213a72748d5440191b4b9f07209723e0b8e2b59f11cafe4b87acd123d2987ed1990d3204402f69b7f78f8607782c441efb307a12a
-
Filesize
599B
MD51cf46555b125f8cc867f47959d154a8f
SHA1bb50ee9a070c5aa2c6eb8787d3cc2493f898a67e
SHA2566229116ce9e3c490303c8c3e136280af7f790b1f89a3e908587e4152783c5b73
SHA512cfdaa0fa8a2cf07483c07a4f9da5bf3b78a49bfc209505b674264ceafb7c08a78249dabd7114f366123b5a1fa227f8ddbabf4dfe903573bd4e539c5102f4f6ba
-
Filesize
484B
MD5966a384457c69ab845c7c38da502d2d7
SHA1a1dabf3f75a84bd1fee6396393f27995f120fdaa
SHA256a33699c91a485a476b6bec853814fb77188d178de7f40a991cbe7bb3f0713942
SHA5126f7d7d8e6854e34aad116d06949e03e7b29a975b7a426873a204d8cb4eed1d4f301012b825dc5f6918ed011cb1f355ee663ae31d5d1e9013beb3c39aac16a5d5
-
Filesize
344B
MD5fcb2c41f68200f489c6ee8f7ccbb8065
SHA134dbe7a5acfb7324118e8028e390d144d0ba9e2e
SHA25688ea5c946f5da95b6d170aa61cf58d2db97b7781fd91bfc1640f107baba804fc
SHA51227370dc098bd7ffebe2d294a8a2c84595cb5256c276dff4f59fb22641988d7726d85ffde15fe17406db750435de1d295254f0cae2d9974a24673132eb208f421
-
Filesize
344B
MD5dd3461e08bbf508db09e2c2f141569f3
SHA1869b80ffdc9886092a2fc60de8be8a8aa73f7db1
SHA25656c64a3a1423ab359d9bd35a5d7441472e23dc63e1f456fa694e7ce4c3567093
SHA5129a575301a78f95d54e4ac7c5d8dc2bf2264ec8e5b206ffae372eedf5e0bedfd71c78f5980e97aa1a0099be396919261e194f12604fbebc802175b137280b0cb5
-
Filesize
344B
MD53c64e68c1d89f1bddd63c4a5ae60416b
SHA12b4e74de304eae9d4f43916468361aa78c3d4854
SHA2563580a584a0ce6a1c860e06ee58d294a58627d87c80b641a6cf67961844ec3619
SHA5125438452869779053e3796200595cb46d9962e5c4ae59e8b9c19d8b0b80fec83fb92f307196ae84f7689c704200d913478aae1550e136ffdff90a6f9a81657018
-
Filesize
482B
MD52658588805d0d0fb188cd6eab60a512c
SHA13126e1dded133f62689b9824dcdb068a6f4420c7
SHA256a2fbc1bc1074c7434d253828015776933069438156fb539378871667031855b3
SHA5129c6822bf6efa436d4e248bd54f96c6df014c7c9f394529c8703577dcb8642a8b2e6f7079e76203214cc8f5d545eeb5564d365aade229c4b36d57696e46365c71
-
Filesize
504B
MD5e858e5d8a272ba5a0d338ad8b8ed0d04
SHA16e420331c575328e1c23f254fb356503285225ab
SHA25697d406b51507e36324517cd7f6deed0968e26eb4afca256471ca550d6029aaa2
SHA512a445562f078ce8fae7940cd11f484286fcab5d02aba0bcf4b0e51fce97493441fbf0e2df3559f4a97155334ac9c2d907780596bd21cfc6c8cb9c82664ecd6810
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
Filesize
415KB
MD522e7b588ff654751bae0f093d8200feb
SHA1e8980d787b2b7b8deeeffe40019fcf905121a535
SHA256f7e4432bab66fdd4dbd7cc153400036d092055a4a986cd6582419290e34b5700
SHA5120f90cd23c5411668fb32fa1bc7c9bcb2f0049efec63f437d6ec6a05ccea257e135f61ca262514c068acd1bb1e352b89f58c0dcd2e624c574598f376c4fb92ac5
-
Filesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9
-
Filesize
447KB
MD53f782ba70701902c1fa7363c7543c236
SHA1673f7415784348b3e896bc4dbc9e18c69956d650
SHA2561ae8d02d7a392324af01091e0707fb8a5bc4e7dfe5cc4f6e308aef3ccbfd62b3
SHA51223f3e6a5b651c8cf566fc4d2de4c3f1a4f91ef6bcdc19fcc1b05eb9b0b880e7e51ce1dbddc89efb0523923390adecfce4c87494497b27bdf89905928215c72ee
-
Filesize
160KB
-
Filesize
12KB
-
Filesize
160KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
680KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
64KB
-
Filesize
708KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
16KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
160KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB