Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
14/11/2023, 13:44
General
-
Target
ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137.exe
-
Size
14.6MB
-
MD5
c90e6d8aaa8c4f7deae7f09ca2fbf3e0
-
SHA1
bf6955618bcc5bbddd732b5fb0b4d7be689f2c80
-
SHA256
ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137
-
SHA512
df8baf02eb192edc654b1f7a8086ccef25292a804d212d00d0abbeff69dbbb4330d58cc63c8331119ec441c9ea0cc856888509ae697ce9624c2efee663d15705
-
SSDEEP
393216:C9I8YV9Q+nB3nj5uAOHXMBlwWmj8RsfxU6dn:0I8YV2iFuAO3MBlwWmI+pJn
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137.exe"C:\Users\Admin\AppData\Local\Temp\ff47792967ca5fa669ac3df77a3e63fe090d11a1f7dc913cbde50eb13f29d137.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 3082⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b22faefc69dca19c92538365925a23c3
SHA162ff3e41c3ba6492ec4a4822e18d2435999a5265
SHA256dea3146fc2e1a5e1986f3cef68335d4d8cbf67832caab00b94e11533b4ef4079
SHA51267a5eb96dbe51ba682b202c4dbd9545cbd164c66a101ea6d106faca9b77347a584fe895e4f0fc3de0507c6115c3740b73eb762252d3ead7016da910e693e5e2e
-
Filesize
478B
MD5604ab6e8333377b42af704eb9628df31
SHA1f4d43da14036f75c8c63749c63ce15895c0335a6
SHA2569eeba70b680fff2901ceecc8347c36a7fa41172bf8459bdbeb4921149db39d97
SHA512e568fb625007545bdec7d13879e67a95abe4c72791dcc2df99a4436c906c46bdd616f76a1279b97296b32fafd153dc9c1a7e6426f1a346b5ad8a12e923b3de61
-
Filesize
199B
MD5240ec2cfbbe052f9d555e43e3ac3e34a
SHA1751511c831243e65a28b52307a3a998e66c0fb25
SHA256351ce87e88addb9b03094c1d6cd8d281876bbffc1c32bd8d915c256930d044a7
SHA5128574ee1862b6c392e357964eebbbdf9bb3d1c3dbc0501db2a4efc6154cd2c91d8c37f29915db9628e26c552ad07133117eb471943ea82fcc8902cefa152127d9
-
Filesize
357B
MD5c39805f6e69dbde445831ea2745ff266
SHA12dce17619c329ada511d225c80073918d6fd7abb
SHA2569646ceeeb3026c36836bc110e17fe2cb9953f29971f3cba7ead1706cc82791e2
SHA512ae4c5173ed3167e7004487c4ec30a7a6968dcd62990915557d29477abab74c10319cc64a230be083434b0dbdafb63f3ea6fbed71ab940b23704135999e7e0d3b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
45.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
45.6MB
-
Filesize
4KB
-
Filesize
45.6MB
-
Filesize
4KB