Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 02:46

General

  • Target

    00d119fc464e81f503dfe92e407e8297.exe

  • Size

    2.3MB

  • MD5

    00d119fc464e81f503dfe92e407e8297

  • SHA1

    f57eb560df81f870b6fb865337c273486dfdc721

  • SHA256

    8da107ea5a07ea1a4ab6c033782d8c0df570f788559d3c6c3b72d452b347e583

  • SHA512

    0834f67cf3e77435279392064ae0d27c70ba01f6113cf65359e5b6887dfaa0c585485f19eb5a7e43c0acd52cdf32c76a2b945c688ccde293f78c17c342373131

  • SSDEEP

    49152:IXWpU1Dost4jUlU/fzcINWRVE67RsNKWFT+yAirGCz:IXWps4jCV90TFTFz6+

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00d119fc464e81f503dfe92e407e8297.exe
    "C:\Users\Admin\AppData\Local\Temp\00d119fc464e81f503dfe92e407e8297.exe"
    1⤵
    • Checks BIOS information in registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1220-0-0x0000000013140000-0x0000000013390000-memory.dmp

    Filesize

    2.3MB

  • memory/1220-1-0x0000000001E20000-0x0000000001FA1000-memory.dmp

    Filesize

    1.5MB

  • memory/1220-2-0x00000000778C0000-0x00000000778D0000-memory.dmp

    Filesize

    64KB

  • memory/1220-4-0x00000000755B0000-0x00000000755F7000-memory.dmp

    Filesize

    284KB

  • memory/1220-1621-0x0000000001E20000-0x0000000001FA1000-memory.dmp

    Filesize

    1.5MB

  • memory/1220-1622-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1624-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1625-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1629-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1633-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1635-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1637-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1639-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1643-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1641-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1645-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1631-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1647-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1649-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1651-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1653-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1627-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1655-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1657-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1659-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1663-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1667-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1673-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1677-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1679-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1681-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1683-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1675-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1671-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1669-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1665-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-1661-0x0000000001FB0000-0x00000000020B1000-memory.dmp

    Filesize

    1.0MB

  • memory/1220-4602-0x00000000778C0000-0x00000000778D0000-memory.dmp

    Filesize

    64KB

  • memory/1220-4604-0x0000000001E20000-0x0000000001FA1000-memory.dmp

    Filesize

    1.5MB

  • memory/1220-4606-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/1220-4609-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB