Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

72706ac1aa...ed.exe

windows7-x64

7

72706ac1aa...ed.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 02:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72706ac1aa2c69f0196765f99d2c04bc7d2176534709c9d51443d63dfc071fed.exe

  • Size

    5.4MB

  • MD5

    5178639ab2b5b73af5b0be07316018ef

  • SHA1

    811a7d9faf6d9cc51fb6aa4bd5daf3124542f6ec

  • SHA256

    72706ac1aa2c69f0196765f99d2c04bc7d2176534709c9d51443d63dfc071fed

  • SHA512

    997aab53fc7157bebc5ef337b01bd6786dfd5a89ffd6278c7dc1ec4867f0aafea3e44c4ede39a9556816fd0056d184ebe345ecdd0b419c75a1c46de9bb75e466

  • SSDEEP

    98304:sD9ifwdJBAUZLS1+j+Kv694dV1a5kh8cyDSzserJ9quNCnkAb0SUtPWRd:7fyJVmi+Kv69a85H1D0JQaIAJWRd

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72706ac1aa2c69f0196765f99d2c04bc7d2176534709c9d51443d63dfc071fed.exe
    "C:\Users\Admin\AppData\Local\Temp\72706ac1aa2c69f0196765f99d2c04bc7d2176534709c9d51443d63dfc071fed.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ÈÕÖ¾\³£¹æÈÕÖ¾.log
    Filesize

    5KB

    MD5

    ce285aeeb64ce014e7a56de9f92606bb

    SHA1

    8389507b33858e4905a425d2ca4160878e4b892d

    SHA256

    375ba85243c81a75111d9c579743d385ea799c71f3a7e25ccbfce1b7a4b21041

    SHA512

    99fdf327ce4a5cd5755601b08f6e7e49ed131b351d579ef8f7aa36c64b2efa6880af0025bb74e4774d3f6b3f7c7908e23fc2a8166127bcbde922f79db0191a40

    Download Submit

  • \Users\Admin\AppData\Local\Temp\E2EECore.3.3.6.dll
    Filesize

    10.7MB

    MD5

    b7f9fba5ac9652dd1b709d96f6efb247

    SHA1

    7b966c4f7312c07b5cc7e6764f34f068d2c1273d

    SHA256

    d02b10f7a7c7f5cda18ce7aa35e577adbfbbeecaf194fe5963a81ae07bac9597

    SHA512

    d451cb784db56ba9c36727afa7be064d803beab782fcff51c4e11c58017cd8ad7464d73a43202b9b02a6e87f7d0f3c699d6533935c1543fdf774712404c7dadb

    Download Submit