Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2023, 13:39

General

  • Target

    Evernote2Onenote.exe

  • Size

    330KB

  • MD5

    13c1e9a0889500950b8b2d4f4a3067b1

  • SHA1

    7d6e214785fb05a6ea4a75f3e017cc55b4aca2bb

  • SHA256

    94af3c23820d65f35c63bd314e01577d27b1f1b499a626cd05f1eb54d354fa26

  • SHA512

    b6583ff25d5510ec4c890a7b13a45078241507c4c5f7bb228f16e508594a500854d87a7bf58cc4487df21a7ea5049a21a976ba4f8f50f52017dbbf153f112da8

  • SSDEEP

    6144:2mU6FMpZtScIlNv7+fBsxyEa8/wf4sxyEa8vjd:DUJDG2DEBtDEBx

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 31 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Evernote2Onenote.exe
    "C:\Users\Admin\AppData\Local\Temp\Evernote2Onenote.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2988-0-0x0000000000B60000-0x0000000000BB6000-memory.dmp

    Filesize

    344KB

  • memory/2988-1-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

    Filesize

    9.9MB

  • memory/2988-2-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/2988-3-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/2988-4-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

    Filesize

    9.9MB

  • memory/2988-5-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/2988-6-0x000000001EA00000-0x000000001EA01000-memory.dmp

    Filesize

    4KB

  • memory/2988-7-0x000000001EA50000-0x000000001EA60000-memory.dmp

    Filesize

    64KB

  • memory/2988-8-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/2988-9-0x000000001B030000-0x000000001B0B0000-memory.dmp

    Filesize

    512KB

  • memory/2988-10-0x000000001EA00000-0x000000001EA01000-memory.dmp

    Filesize

    4KB