Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/12/2023, 20:50
General
-
Target
11fbc728d4a2c94f6d8b1e549a0830cb.exe
-
Size
184KB
-
MD5
11fbc728d4a2c94f6d8b1e549a0830cb
-
SHA1
b743592f6eff851b5ed5f93b9c427e532c79231c
-
SHA256
bdcd414bf8badc08fdde0674afea0c055d3ee12b2efd50308db9c0ff3f55c571
-
SHA512
51feb09f750b0ac756ae01dd3e939540d9939c07f470c20574d1666bd37a52541b622ac53dea9db6549de72dc3ad9e8f92e532f198a9f0e70d756f3f66ce4756
-
SSDEEP
3072:Pdq0O1czVCAgbLZUv4QYRDFHKsGfq/4u/x0hQh:Pdq0LZCAsLZRQsDFHNGy/4uSc
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11fbc728d4a2c94f6d8b1e549a0830cb.exe"C:\Users\Admin\AppData\Local\Temp\11fbc728d4a2c94f6d8b1e549a0830cb.exe"1⤵
- Drops file in Drivers directory
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD5dc3a993f4110080d7df7c72742afc727
SHA13d3b8d670c0f999a72773b0e677e5320a0ae1c03
SHA2566a14bc4a299ce66c2001c9c2dbc236e04171de4f03170b8a394203db3392496e
SHA51297707f23c9520bd21c555fe8fcca5842078cc4b9117421223422cdfd5f1b8416dcb759fd6ba774e3387b90d8dd4aa8b689db9786c665f40a640d4fe0d31e3970
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB