Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    213s
  • max time network
    248s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 16:26

General

  • Target

    2cffea1a8b250322814985924dbc4a80.exe

  • Size

    268KB

  • MD5

    2cffea1a8b250322814985924dbc4a80

  • SHA1

    396e72627e1aca3faab789a3bc9f145960f8a95a

  • SHA256

    647615ccb7d1795429d5720476049f3a087d72f1bd67cc61fff9aa3835feab94

  • SHA512

    f089aabd94ecd2b448f21bf0e420ff708422814e44dc0bc68fde837893e72ecf2b7e5a8a057d3930ae2a02cc8ac04883ab4d8b5ad85c7e518471692b8a8bf384

  • SSDEEP

    6144:AI1v9PfKoXjllMoVpfZLijwDAhtCx6o3yG4/xFk:A4vFfVzv2qZitZFk

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cffea1a8b250322814985924dbc4a80.exe
    "C:\Users\Admin\AppData\Local\Temp\2cffea1a8b250322814985924dbc4a80.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    821348ee5170f13162ffdd8553a0b71d

    SHA1

    ee100a01c4f9c881979590b07d66bda2bc5268a6

    SHA256

    f955add5fea2a639c2643c0d7df1625384e515771c7bb299d5508fb82908f1d5

    SHA512

    8af709612c34dcb49cec8ab6edbf0ba0589f5e9a77ce8ac686af8d88f6f3bbfe08a84e338f95e130cf269f84dbf1c464af2676f3f8c31fc0bdb711d2fb5dada2

  • C:\Users\Admin\AppData\Local\Temp\5584.tmp

    Filesize

    715B

    MD5

    587be65a5dd511a9c7cf5c53a0dde1df

    SHA1

    47bf97e955842990ef23b199d9c448886af30d15

    SHA256

    4f149c2ac62924f2999c207ec8a05337aafd43cccbddaf1c75dfb00d09a341fa

    SHA512

    10828a505bef5081749a1709063a43e02dbd1a5e6b71c7577914d65993632d82741bcc90f17db919fa3a52ca5b543b5783b8842a2e40c534dda1ca0ab1665873

  • C:\Users\Admin\AppData\Local\Temp\CabEE5E.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar940.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/2580-0-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/2580-1-0x0000000000230000-0x0000000000299000-memory.dmp

    Filesize

    420KB

  • memory/2580-2-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/2580-3-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/2580-5-0x0000000001CB0000-0x0000000001D6F000-memory.dmp

    Filesize

    764KB

  • memory/2580-7-0x0000000001CB0000-0x0000000001D6F000-memory.dmp

    Filesize

    764KB

  • memory/2580-9-0x0000000001CB0000-0x0000000001D6F000-memory.dmp

    Filesize

    764KB

  • memory/2580-11-0x0000000001CB0000-0x0000000001D6F000-memory.dmp

    Filesize

    764KB

  • memory/2580-13-0x0000000001CB0000-0x0000000001D6F000-memory.dmp

    Filesize

    764KB

  • memory/2580-15-0x0000000001CB0000-0x0000000001D6F000-memory.dmp

    Filesize

    764KB

  • memory/2580-16-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-18-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-20-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-21-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-51-0x0000000000230000-0x0000000000299000-memory.dmp

    Filesize

    420KB

  • memory/2580-53-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-54-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-55-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-56-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-57-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-58-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-59-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-63-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-65-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-64-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-61-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-66-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-67-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-62-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-60-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-68-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-69-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-71-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-75-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-77-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-76-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-78-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-80-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-74-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-81-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-85-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-88-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-92-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-95-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-93-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-94-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-91-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-90-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-89-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-87-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-86-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-84-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-82-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-83-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-79-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-73-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-72-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-70-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB

  • memory/2580-175-0x0000000002060000-0x0000000002126000-memory.dmp

    Filesize

    792KB