Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 14:40

General

  • Target

    764ca431f151e7ccbd3ac45edc55d301.exe

  • Size

    22KB

  • MD5

    764ca431f151e7ccbd3ac45edc55d301

  • SHA1

    4205cf84ce706c67328b3c3595f7d0c972fe53b1

  • SHA256

    c25ff38a472074dce31afd1c4bb0664b478850cf56a893213b7617544a29a16b

  • SHA512

    eb8be6bdecc7928e7e4f01a51e2ac670da46fa41e6f4fc86da7777c190bc581e29b98310e804e40c4c45d860569ddefd168ef7aaeef97b80f85d2d2f9a8a37f8

  • SSDEEP

    384:OrBsV6vQJ5Xp+VP1ZL39jKOtJ/GI+4fcX+FlmySrsYENRlSd5X:GBNoJ5XcZ1939uOtJeBwmyisYElS3

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\764ca431f151e7ccbd3ac45edc55d301.exe
    "C:\Users\Admin\AppData\Local\Temp\764ca431f151e7ccbd3ac45edc55d301.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\764CA4~1.EXE >> NUL
      2⤵
      • Deletes itself
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\122B901E.dll

    Filesize

    15KB

    MD5

    10f11aa05d51d4518346fd89d98f19eb

    SHA1

    8d979e85d93ad1a59d819cb2666b3e6d9947bc3f

    SHA256

    38c322ff34499f3121024be2c3beb433792f78770102a12dbcf59b5b97ec3348

    SHA512

    f67c92b6bb4cffa040f7b7575613cdbce8b58ed090221a5ac0f1f2a8bc00d9ba071c423bfcad475f1f6bd9a910d2a9cc76fc0091340d1e05b18b350cf43d3879

  • memory/2224-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2224-6-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/2224-8-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/2224-7-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB