Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 21:18

General

  • Target

    12b0a232a809b9ce95dbbd993927c9a6.exe

  • Size

    276KB

  • MD5

    12b0a232a809b9ce95dbbd993927c9a6

  • SHA1

    66983468c5dfe5776ec15bf6f6b74183c0266f86

  • SHA256

    51c2d268bfa50f68f7d7bffcc755d5da07a8d110e79f3bc540d179a791a9478c

  • SHA512

    b719146969b3b03d945858a198894a58e66939bc43e151c206301678b3b938337bffd85ff80b30f9aa04e06030d5d9b22cc745da524b4027d04920667573ebe0

  • SSDEEP

    6144:k/1HnOBywO+PnbfMIQFSQMX0Wy6XtdFCGJvi5w:kNQuU1XXdyvGJo

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12b0a232a809b9ce95dbbd993927c9a6.exe
    "C:\Users\Admin\AppData\Local\Temp\12b0a232a809b9ce95dbbd993927c9a6.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2096-0-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/2096-1-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

  • memory/2096-3-0x0000000000460000-0x0000000000512000-memory.dmp

    Filesize

    712KB

  • memory/2096-5-0x0000000000460000-0x0000000000512000-memory.dmp

    Filesize

    712KB

  • memory/2096-7-0x0000000000460000-0x0000000000512000-memory.dmp

    Filesize

    712KB

  • memory/2096-11-0x0000000000460000-0x0000000000512000-memory.dmp

    Filesize

    712KB

  • memory/2096-9-0x0000000000460000-0x0000000000512000-memory.dmp

    Filesize

    712KB

  • memory/2096-13-0x0000000000460000-0x0000000000512000-memory.dmp

    Filesize

    712KB

  • memory/2096-14-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-16-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-19-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-18-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-42-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-43-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-41-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-40-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-45-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-44-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-47-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-48-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-49-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-46-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-50-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-51-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-52-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-53-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-54-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-56-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-55-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-58-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-59-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-57-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

  • memory/2096-60-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-62-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-61-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-63-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-64-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-65-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-66-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-67-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-69-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-70-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-71-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-73-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-72-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-75-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-74-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-76-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-77-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-78-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-85-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-79-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB

  • memory/2096-294-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/2096-427-0x00000000024B0000-0x0000000002568000-memory.dmp

    Filesize

    736KB