Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 10:09
General
-
Target
66220981e412954659871d15d3233aa5.exe
-
Size
545KB
-
MD5
66220981e412954659871d15d3233aa5
-
SHA1
58b4edb45aa4d82bdad5a95e291d88edf059362f
-
SHA256
b53e2621741d5018ba587c1bd993e1f489976376342c7be05c1dfa464b524d6e
-
SHA512
d8add1749dae553e2b64bf662b3a896e0f01bd4470684dc5df3540a7c31dcecdd6117a6aea5bba10325620e43689836f17e26227ed740bf536fee740d2792ef9
-
SSDEEP
12288:x1Ra1rN4wopVauKAxZkhwryINtTirdor2vzFyq:xDrp4XAx+hwrywTEdoSvo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"1⤵
-
C:\Windows\EntSver.exeC:\Windows\EntSver.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66220981e412954659871d15d3233aa5.exe"C:\Users\Admin\AppData\Local\Temp\66220981e412954659871d15d3233aa5.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5d58f992c53515c9f1fb9394a46f4cb48
SHA11f9909d227b93be10328e0abc64052da984657ba
SHA25650c6b8848b0a9cf6a6b579928dc6e5c75cf7564c19bb7b40d86ba9d360ebb040
SHA5123a87c279fbbbaff2bfe791c523716ad092c41099b8914ba369565014502d408084259d4efe6896d785c024935b181ca34cf49e3b79f3f1a89ee1c9d775635d94
-
Filesize
545KB
MD566220981e412954659871d15d3233aa5
SHA158b4edb45aa4d82bdad5a95e291d88edf059362f
SHA256b53e2621741d5018ba587c1bd993e1f489976376342c7be05c1dfa464b524d6e
SHA512d8add1749dae553e2b64bf662b3a896e0f01bd4470684dc5df3540a7c31dcecdd6117a6aea5bba10325620e43689836f17e26227ed740bf536fee740d2792ef9
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
72KB
-
Filesize
1024KB
-
Filesize
1024KB