Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 22:53

General

  • Target

    ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207.exe

  • Size

    7.3MB

  • MD5

    0fc6fb78a0a489990c43c4712916e609

  • SHA1

    1cacce07ebf085405ad569ed9f9702af6f2fbcc1

  • SHA256

    ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207

  • SHA512

    1abfeaaf837d2132c78bfc0758fa55dcfcb46e01a534f5892a9439c256c32f9686d46e46a5a7a398456971368e2750398998189a6684d97cfd8db8933f222e93

  • SSDEEP

    196608:IQWflVkdVlM33DpXaodHQiGE/NBTawX8:IQ6VrHk+QvuNBT

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207.exe
    "C:\Users\Admin\AppData\Local\Temp\ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\HPSocket4C.dll

    Filesize

    1.7MB

    MD5

    707aa56cf742eb934185edf0a69d7289

    SHA1

    dab68976c4bd2d420c8adcd268fc1ffdd5e277e0

    SHA256

    3582d7ad93c54c2efddac6df4cf7d9e4b2ef1d8895dc9d12a781faf3cfb8bf12

    SHA512

    8be50ffedd0a250b4519069cec5781a9d0182fe47dce79c1991fc775a9580550c4b512de37e3423dc5d22013dce4cdcb1f178becbf5ef8ccb610c7ccd6d0f54d

  • memory/1280-21-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1280-26-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1280-5-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1280-8-0x0000000000400000-0x000000000147A000-memory.dmp

    Filesize

    16.5MB

  • memory/1280-9-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1280-6-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1280-16-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1280-14-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1280-11-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1280-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1280-4-0x0000000000400000-0x000000000147A000-memory.dmp

    Filesize

    16.5MB

  • memory/1280-24-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1280-19-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1280-29-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1280-31-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1280-32-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1280-34-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1280-37-0x00000000777E0000-0x00000000777E1000-memory.dmp

    Filesize

    4KB

  • memory/1280-36-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1280-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1280-45-0x0000000000400000-0x000000000147A000-memory.dmp

    Filesize

    16.5MB