Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 08:26

General

  • Target

    11ef17e993626c9ffd229d0ad329e5a9.exe

  • Size

    602KB

  • MD5

    11ef17e993626c9ffd229d0ad329e5a9

  • SHA1

    87d6223b3a3c14f380da1a5e581c124a78f0e8aa

  • SHA256

    32f8af57fdfb2cc83432fb295ba83f09d8d3c70bd3062fb4b26f8a501fd83009

  • SHA512

    cf7b5ee0b60a8d173d94af966bee61aa33c965c3b73bbf503718b4a5f4d06c62142e6165e8de1194827fd880d26140bc8e2a231ca133a2c40816caca24664912

  • SSDEEP

    12288:xmkaMWNGlM8sso58vxLSfQ2kPmUMILeJShM14SRBrMoip:xfkNr8YQWfQTPmAyJ+M+SRBrM

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11ef17e993626c9ffd229d0ad329e5a9.exe
    "C:\Users\Admin\AppData\Local\Temp\11ef17e993626c9ffd229d0ad329e5a9.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 1628
      2⤵
      • Program crash
      PID:1440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ish259395966\bootstrap_32811.html

    Filesize

    156B

    MD5

    1ea9e5b417811379e874ad4870d5c51a

    SHA1

    a4bd01f828454f3619a815dbe5423b181ec4051c

    SHA256

    f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

    SHA512

    965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

  • C:\Users\Admin\AppData\Local\Temp\ish259395966\css\sdk-ui\progress-bar.css

    Filesize

    632B

    MD5

    8f6a2e09ace79158461b82d74ff6c7fd

    SHA1

    88f079fd001feb2cb302565b87fdb81c8995dd93

    SHA256

    b4bee76334ab9b4b0bdd2bff1b3f3a7b30d2e758bb8d4c6e457c9594bb62960c

    SHA512

    869305ea12f21564e56882fef318cdc21f88715f894e8140ae6b2cf3137a4c2002a34f2f8ae2719f770e2d0c892244b5e5f3229f1382e799dd309f52657cb98e

  • memory/2332-2-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2332-0-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-90-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-94-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-96-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-97-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2332-95-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-92-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-91-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-1-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-143-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-147-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-144-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-148-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-152-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-174-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-175-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-179-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-165-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-184-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-183-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-182-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-181-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-180-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-154-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-186-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-149-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-187-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-189-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-191-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-192-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-196-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-199-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-198-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-197-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-201-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-203-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-205-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-208-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-209-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-211-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-206-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-214-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-212-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-215-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-217-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-219-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-220-0x0000000001D50000-0x0000000001E78000-memory.dmp

    Filesize

    1.2MB

  • memory/2332-256-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB