Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 12:31

General

  • Target

    1e94f52b4660a9692c8ae2f86bfe8c34.exe

  • Size

    252KB

  • MD5

    1e94f52b4660a9692c8ae2f86bfe8c34

  • SHA1

    47e416c1b02be4039be022563a65316f580b3771

  • SHA256

    f88910dc5b4324d2633bab63e013cc1792f1fc8d1f4c32a92c90aa44eaccb4a4

  • SHA512

    d0e28f1a939457c462fe0c5d79127e17bb8135c89c1798ac4b1674650da6374dce4142c0872d0092db4f082b692b4547d9189a0ceb6a6f833b9ff5ab3c3d88a7

  • SSDEEP

    6144:Gg9SJ3GmB+gw8quOMdwD5xTse7P+BMbA5QwEgNV0gShqlHfl:jSJWmMB6OM6VxAeD+qbA5LEgNKhCHfl

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e94f52b4660a9692c8ae2f86bfe8c34.exe
    "C:\Users\Admin\AppData\Local\Temp\1e94f52b4660a9692c8ae2f86bfe8c34.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2924-0-0x0000000000340000-0x00000000003A6000-memory.dmp

    Filesize

    408KB

  • memory/2924-1-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2924-7-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

  • memory/2924-13-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

  • memory/2924-19-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-17-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-15-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-11-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

  • memory/2924-9-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

  • memory/2924-5-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

  • memory/2924-3-0x00000000024F0000-0x00000000025A2000-memory.dmp

    Filesize

    712KB

  • memory/2924-40-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-55-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-57-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-67-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-77-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-86-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-85-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-84-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-83-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-82-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-81-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-80-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-79-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-78-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-76-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-75-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-74-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-73-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-72-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-71-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-70-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-69-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-68-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-66-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-65-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-64-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-63-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-62-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-61-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-60-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-59-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-58-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-56-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-54-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-53-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-52-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-51-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-50-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-49-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-48-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-47-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-46-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-45-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-44-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-43-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-42-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-41-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB

  • memory/2924-555-0x0000000000340000-0x00000000003A6000-memory.dmp

    Filesize

    408KB

  • memory/2924-757-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2924-1036-0x00000000026B0000-0x0000000002768000-memory.dmp

    Filesize

    736KB