Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 18:13

General

  • Target

    33a2083427819549057ef5b4bb27d8ba.exe

  • Size

    512KB

  • MD5

    33a2083427819549057ef5b4bb27d8ba

  • SHA1

    47a1dc9be87e82338cb21a18d98c2314dfc511c5

  • SHA256

    101a586bc0374469755bccb6297e270a63de3e47106bc037167dcb4d1cd8611f

  • SHA512

    45e7b3244fdeed65f1e34406e3976b63d2f1c4e3a60b1fc32e857d440093522b39a7ee1aae26f9a11b0d258d28915a3d19e8b4c2cf2f14c4509ed3d386d70aac

  • SSDEEP

    12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4d:0+h9OY70z+warul3E4d

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33a2083427819549057ef5b4bb27d8ba.exe
    "C:\Users\Admin\AppData\Local\Temp\33a2083427819549057ef5b4bb27d8ba.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\n3488\s3488.exe
      "C:\Users\Admin\AppData\Local\Temp\n3488\s3488.exe" 55800887e41131118532bd48+B3mC6F65i2R7fGcfGTYwOrpMafhDd8MFUfNWxuXSrajo3yDGY0FCCBSWgTLn0vh/r6xhQcZmHmsw0lBhg5Z/luBh3WYu+mdF7XAuz+62ZR7bslhBTRp3eENw9uV2c7aCIpSUFs79jncak6fBeRPNmhv /v "C:\Users\Admin\AppData\Local\Temp\33a2083427819549057ef5b4bb27d8ba.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n3488\s3488.exe

    Filesize

    93KB

    MD5

    865e5dceb303b3b220ef1ff9a55973e9

    SHA1

    60cc9d42d53a03eeb33ff29664d41f37ba2d14bc

    SHA256

    f1592f556fd768bae9cb974081459214b453c1121e3858e6c448c08d5823e2c4

    SHA512

    5dda61214c7a098445793ec3f17794ce5afa2f84f3b6b4db6e5366cab8921d4331dc70abc1cf3235753fe1165a358f87a22ef2f17049a0e1e6f9dab342202a2a

  • \Users\Admin\AppData\Local\Temp\n3488\s3488.exe

    Filesize

    98KB

    MD5

    050d222a9d4f79108a8f66f8c9de29d8

    SHA1

    9206b374503738d7524d04fa47543f48b8571b99

    SHA256

    bc235a4685b36719d210edb9592645b93c9f9070cb369579b725fb4e400e8c2b

    SHA512

    74e5a6c414886758e044570b753cf4896d323c6516074ed1c37f02257f9420ca3f316bc141819c6f2554846fb76a3b8734abb29f47c0ce0d139e91a5e3b95e36

  • \Users\Admin\AppData\Local\Temp\n3488\s3488.exe

    Filesize

    230KB

    MD5

    abaf13cb23de482dc944ab5b51ca3aac

    SHA1

    76837356db96dd56b647aba60f1adbbdc7b200fe

    SHA256

    b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

    SHA512

    cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

  • memory/2496-72-0x00000000005E0000-0x00000000005F2000-memory.dmp

    Filesize

    72KB

  • memory/2496-22-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

    Filesize

    9.6MB

  • memory/2496-23-0x00000000009F0000-0x0000000000A70000-memory.dmp

    Filesize

    512KB

  • memory/2496-73-0x00000000009F0000-0x0000000000A70000-memory.dmp

    Filesize

    512KB

  • memory/2496-74-0x00000000009F0000-0x0000000000A70000-memory.dmp

    Filesize

    512KB

  • memory/2496-75-0x00000000009F0000-0x0000000000A70000-memory.dmp

    Filesize

    512KB

  • memory/2496-77-0x00000000009F0000-0x0000000000A70000-memory.dmp

    Filesize

    512KB

  • memory/2496-76-0x00000000009F0000-0x0000000000A70000-memory.dmp

    Filesize

    512KB

  • memory/2496-78-0x000007FEF59E0000-0x000007FEF637D000-memory.dmp

    Filesize

    9.6MB