Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

47ae8e27e1...96.exe

windows7-x64

9

47ae8e27e1...96.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 01:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    47ae8e27e126f88f937ff6e6efb7cf96.exe

  • Size

    1.2MB

  • MD5

    47ae8e27e126f88f937ff6e6efb7cf96

  • SHA1

    85ee4bea24d0bbce0d663703581ef94433847dca

  • SHA256

    ff6cb70170510fd46c809872416202ba82469dfcbd469714247460a3114c35c5

  • SHA512

    933ee00a937859dcb6ae627dd8dfe2588b57b53a9b55bbd831f9f15efc7a64b4c3eb8d0a5fafb8e44812afd50fb517e0b241673171bf0e2f09f5c6389b2da249

  • SSDEEP

    24576:1YIwCm/GOsBgo0q4wMUp1AjEyqAnwgf1BxnBErH:16voHMUUj7Tn5RBE

Score
9/10

Malware Config

Signatures

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe
    "C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hoodxc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3D1.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2608
    • C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe
      "C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe"
      2⤵
        PID:2484
      • C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe
        "C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe"
        2⤵
          PID:2560
        • C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe
          "C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe"
          2⤵
            PID:2260
          • C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe
            "C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe"
            2⤵
              PID:2568
            • C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe
              "C:\Users\Admin\AppData\Local\Temp\47ae8e27e126f88f937ff6e6efb7cf96.exe"
              2⤵
                PID:648

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpF3D1.tmp
              Filesize

              1KB

              MD5

              401128337f3c5dbc94e510928e792486

              SHA1

              95053dea2560e1556914bb827afb88b4f4000d43

              SHA256

              9d5320359d3363c31a254bdfb1048d5d069ab27927ebcfddbfa8949b6ac75be7

              SHA512

              01127d56cf0f99e18eee076e48588e4d224947a64395af4cda563c001aadbca89cf0dc75fce0cb8d0fa62b756c912d0cf219e636700b30b33c71b3ca147d17db

              Download Submit

            • memory/2504-0-0x00000000003B0000-0x00000000004F0000-memory.dmp

              Filesize

              1.2MB

              Download

            • memory/2504-1-0x0000000074500000-0x0000000074BEE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2504-2-0x0000000004890000-0x00000000048D0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2504-3-0x0000000000280000-0x0000000000292000-memory.dmp

              Filesize

              72KB

              Download

            • memory/2504-4-0x0000000074500000-0x0000000074BEE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2504-5-0x0000000004890000-0x00000000048D0000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2504-6-0x0000000004910000-0x0000000004994000-memory.dmp

              Filesize

              528KB

              Download

            • memory/2504-7-0x0000000000760000-0x000000000079C000-memory.dmp

              Filesize

              240KB

              Download

            • memory/2504-13-0x0000000074500000-0x0000000074BEE000-memory.dmp

              Filesize

              6.9MB

              Download