Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
12/11/2023, 16:39
General
-
Target
tmp.exe
-
Size
20.5MB
-
MD5
568963c3941031bac6b0efe3df5676c6
-
SHA1
3bdd30ae7c9e04b12cf81ed2bbf7055249e61a67
-
SHA256
cc5681366e3d73afc8fece1a15e9764543148449f7a1eddc9fb7705752c1b342
-
SHA512
d371d876756578868aaa8ed6f41b7e858e20f0b24256ed5134a2332ce2cb12483f7eb153ee447506e931f74b92a707939a3e54ab2ee1884f1955feaf011422bf
-
SSDEEP
393216:7RohnkAi/3eCseDV+w5xP9AOgBq0hvc1npNQrfJbCcDitpnz51:7UkbveI+w5xVAORNpNQrhbCi6nz51
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Windrivex086.exeC:\Windows\Windrivex086.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5ea4afc3afe953263adabd1f86d4622d4
SHA1f863869019db8b8102a30421e861606cbda77e6b
SHA2566a84fabd3be5bf5e7dcbdb849fc80dfd1b4807164bf343e2876b0d0286189c73
SHA512e80b7cf4fb7ff4b40186da0a0020a2f04bd126cb6a069ededb054310bb32f3dd6c5c7191fca5a37e0ef4f9758fe6f9fc56f19de35af54febe46acd9344aa0b04
-
Filesize
73KB
MD53722f3bbd3b7a1433ef8aca28b3bfba4
SHA117c9fc0515fead507a5dd4d4778aaf46c1b33ab1
SHA256644711742c67a5a9c49306d5eeac6992e99e44a3d075b555ef5b3aeae507a8e8
SHA512da0c5970b164006dfe4b7b3fc6677a94fe1a80f42df3eae8f3c07df3fc4573889121548aee232b54908a8f3a1592c5026d3618c583d2dcfa34973ef4d07b6c2b
-
Filesize
2.4MB
MD55cff2b2b2c0170352c0771f9b6845cd1
SHA1b3a99ce8ddb3e8526ff5772e5bc0821af5633cc1
SHA256e28ebb5314382c4299126ae49fe9b8ecb5e24681635de9c138fb4db2020430e6
SHA5125391afb463ea7b0f2970455741c535eafc3502406e0a7923b21c62d40767744845b0d6db74a556249d8b9ff81eb764039ceef8229c00e5017d51896869a08336
-
Filesize
10.1MB
MD52fdd7abd6b8e3fd9ba425405d88d3340
SHA14291099d2a18b41a1b1e5fcc3c71bf256cc97ed2
SHA2565ea3a1f359bdfd143c1df71430fb531af8430a0c33080d4907c135c35134b871
SHA51214f78ef5e272cc1b5e53aad8ab27fc66112adfc1dd40ef98a743ad8b052601a9b6006f5e0e77c4a652bc19a08cb6e8fb66275761619677635693378a3ea54805
-
Filesize
732KB
MD53d15f4128ddfeb0acdfa225dfb27561d
SHA16b469f93831c5f62bc87edac851b1c82fa322025
SHA256aafcc78bf089491b4910963d7b4e02652f6137d475e09dbd6fbf1339e0c95203
SHA512ebaa89042828814ba0a37cc253815c5930f65875585aacb302eae084f12f82d6f265ea0eb6b9fba0e58084fcb2096b83fbacbb3cb67754b6dbeca5b15a4b62da
-
Filesize
1.7MB
MD553ff44296e596a49b79b36f4d174122d
SHA1b690c4a5e76ca65592a90fc6ee009905180a954f
SHA2569e8cc8087e6b0ea13c95b65b06457f8e710bc768fc3617b18e9b376f44410130
SHA512715cb9ee28983129b7aa7dd0571a081b501e2fd41b1fa54a5b292903038bf6e99812fc316b991de13b5f10ecd2e8c305f16bad6231839897603d22c098374599
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
69.3MB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB