Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    195s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 15:38

General

  • Target

    29ec600836346c641b153f753ed721fa.exe

  • Size

    503KB

  • MD5

    29ec600836346c641b153f753ed721fa

  • SHA1

    1491d34b229bf06de9c791e6b28eb91d13e542e2

  • SHA256

    77f03b6e7ff483c1e4e156f1279a0d3d788494968917f6f947505b762dcb12d5

  • SHA512

    b32231ada19d28829063b72e21f16fb42c2711a61ddaf3eaf804dcb236384528d5a95587cf77363804b1e4ffdf99e25b83d02d1d0225e1bd2c05151daa904f94

  • SSDEEP

    12288:yc+qifEn16C7bFZr8nnnImLkBlTAHDOR96Btb1:12EF7Jl8ImRjORWb

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 5 IoCs
  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29ec600836346c641b153f753ed721fa.exe
    "C:\Users\Admin\AppData\Local\Temp\29ec600836346c641b153f753ed721fa.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1088
  • C:\Windows\WinMgmt.exe
    "C:\Windows\WinMgmt.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies security service
    • Windows security bypass
    • Deletes itself
    • Executes dropped EXE
    • Windows security modification
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\WinMgmt.exe

    Filesize

    138KB

    MD5

    e5d062771b8b67dde1e3a31b8b5850b1

    SHA1

    db14def0e2cce8779ae17d8c8fcb0f0ba520e2cf

    SHA256

    227376096aed7541e4d34dbcfb8c8ce16e6a827ee4746bf2eb503f65eb3d8b96

    SHA512

    84ae50162e13c5ed847c9883dd23284a85236565ac65b8d3e07899ccb66dc10d5569102ad81ad79a43742f457ee82b9ba1e00456564683ed7c9489ae245bdcdd

  • memory/1088-0-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/1088-2-0x0000000004100000-0x0000000004101000-memory.dmp

    Filesize

    4KB

  • memory/1088-1-0x0000000004050000-0x0000000004052000-memory.dmp

    Filesize

    8KB

  • memory/1088-3-0x0000000004090000-0x0000000004091000-memory.dmp

    Filesize

    4KB

  • memory/1088-9-0x0000000004110000-0x0000000004111000-memory.dmp

    Filesize

    4KB

  • memory/1088-8-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB

  • memory/1088-7-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

  • memory/1088-6-0x0000000004120000-0x0000000004121000-memory.dmp

    Filesize

    4KB

  • memory/1088-11-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-13-0x0000000004050000-0x0000000004052000-memory.dmp

    Filesize

    8KB

  • memory/2596-25-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-19-0x0000000004040000-0x0000000004041000-memory.dmp

    Filesize

    4KB

  • memory/2596-18-0x00000000040E0000-0x00000000040E1000-memory.dmp

    Filesize

    4KB

  • memory/2596-17-0x0000000004030000-0x0000000004031000-memory.dmp

    Filesize

    4KB

  • memory/2596-16-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

  • memory/2596-15-0x0000000004090000-0x0000000004091000-memory.dmp

    Filesize

    4KB

  • memory/2596-14-0x0000000004100000-0x0000000004101000-memory.dmp

    Filesize

    4KB

  • memory/2596-22-0x0000000004120000-0x0000000004121000-memory.dmp

    Filesize

    4KB

  • memory/2596-12-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-21-0x0000000004060000-0x0000000004061000-memory.dmp

    Filesize

    4KB

  • memory/2596-23-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-24-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-20-0x0000000004110000-0x0000000004111000-memory.dmp

    Filesize

    4KB

  • memory/2596-26-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-27-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-28-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-30-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-31-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-32-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-33-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-34-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-35-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-36-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-37-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB

  • memory/2596-38-0x0000000000400000-0x000000000058A000-memory.dmp

    Filesize

    1.5MB