Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2023, 14:30

General

  • Target

    e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a.exe

  • Size

    5.8MB

  • MD5

    f703d0c1bba5031a46b5b6e3255adcf1

  • SHA1

    7a8bcbb259eae6be1853dd415a7f398237199197

  • SHA256

    e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a

  • SHA512

    141283a2a97bca1cf37fa9a48afe9d0591c72c3c02e41fffb810293d46ebc401f7a46267353ec9c08089f32704b1bb1fbf4faac19b5e371644962021d3c01c40

  • SSDEEP

    98304:u4ozkICynsGJO3yOiQWgCmXt0yQrwUYmR8mpVMAHxESdxLH6TwFQtBy9IMN:6wXyfOiO2wteLYmR1pVMARENTwFfWMN

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a.exe
    "C:\Users\Admin\AppData\Local\Temp\e0ae1670271e06a708f2d872e6fe7ba4d6bbea4b48a3fd74446a24407f85f34a.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2944-0-0x0000000009020000-0x0000000009E4D000-memory.dmp

    Filesize

    14.2MB

  • memory/2944-2-0x0000000077F70000-0x0000000077F71000-memory.dmp

    Filesize

    4KB

  • memory/2944-4-0x0000000077F70000-0x0000000077F71000-memory.dmp

    Filesize

    4KB

  • memory/2944-1-0x0000000009020000-0x0000000009E4D000-memory.dmp

    Filesize

    14.2MB

  • memory/2944-8-0x0000000076CA0000-0x0000000076CA1000-memory.dmp

    Filesize

    4KB

  • memory/2944-11-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2944-12-0x0000000077F70000-0x0000000077F71000-memory.dmp

    Filesize

    4KB

  • memory/2944-15-0x0000000076CA0000-0x0000000076CA1000-memory.dmp

    Filesize

    4KB

  • memory/2944-18-0x0000000009020000-0x0000000009E4D000-memory.dmp

    Filesize

    14.2MB

  • memory/2944-19-0x0000000009020000-0x0000000009E4D000-memory.dmp

    Filesize

    14.2MB

  • memory/2944-20-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB