Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 16:04

General

  • Target

    2ba5dac82373e08ca0a91d328cdd0a30.exe

  • Size

    456KB

  • MD5

    2ba5dac82373e08ca0a91d328cdd0a30

  • SHA1

    9d294241f0ef398f454262d07037591e4fb871d9

  • SHA256

    00727d631a6474c7051cf5ddc13a8c7c079a0d547c0af99c40e117bc4e277987

  • SHA512

    816a0feac3649d8cef29814cfeb7663a7bed631cb2ffcdad4f0b86cde89d05d2e7e8650b9a95b0e288958c402e9e0755f1850c8abd4cb44ef2c5e0ad0d26c8c6

  • SSDEEP

    12288:sst3P2j5+5ZeObQWgxeT0uaSa8QZ7p5y:Jt3PE5gZebWfYujE7p

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables taskbar notifications via registry modification
  • Windows security modification 2 TTPs 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ba5dac82373e08ca0a91d328cdd0a30.exe
    "C:\Users\Admin\AppData\Local\Temp\2ba5dac82373e08ca0a91d328cdd0a30.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2096-0-0x0000000000220000-0x0000000000226000-memory.dmp

    Filesize

    24KB

  • memory/2096-1-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2096-2-0x0000000000230000-0x0000000000233000-memory.dmp

    Filesize

    12KB

  • memory/2096-3-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2096-9-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2096-12-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2096-17-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB