Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
29/12/2023, 22:09
General
-
Target
053c66e85ef10e8739c81f88bcc31f46.exe
-
Size
279KB
-
MD5
053c66e85ef10e8739c81f88bcc31f46
-
SHA1
9dd9dadc44f0baa3d79bea12a70a752c01c73acc
-
SHA256
9a887bbced1bee87fced0151f30a95c4b1377760a179493e1717eaae55d725e8
-
SHA512
f5661bab3194a6ea5407154a5d798dbbaef5d58ed3098d2f6f7ff43c45560c19581e098c5cb63a43516d1dd9801163937c71f0b127e5c4d8e9a0e25536831038
-
SSDEEP
6144:u7O70l65RAHqjeEnoz5OEKS64y5eUSqX5kdpfkQr7ZBfE9M:u7ARGgdoz5LDsOddkUBc9M
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Disables taskbar notifications via registry modification
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\053c66e85ef10e8739c81f88bcc31f46.exe"C:\Users\Admin\AppData\Local\Temp\053c66e85ef10e8739c81f88bcc31f46.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\053c66e85ef10e8739c81f88bcc31f46.exeC:\Users\Admin\AppData\Local\Temp\053c66e85ef10e8739c81f88bcc31f46.exe startC:\Users\Admin\AppData\Roaming\97D8B\63E8F.exe%C:\Users\Admin\AppData\Roaming\97D8B2⤵
-
-
C:\Program Files (x86)\LP\8F29\474.tmp"C:\Program Files (x86)\LP\8F29\474.tmp"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\053c66e85ef10e8739c81f88bcc31f46.exeC:\Users\Admin\AppData\Local\Temp\053c66e85ef10e8739c81f88bcc31f46.exe startC:\Program Files (x86)\8BFC7\lvvm.exe%C:\Program Files (x86)\8BFC72⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5753445cd5a533ed278a99fbfaed7e38e
SHA154fba6acd1d323746ea5259c8dbfcb7d938cbe04
SHA256cbf92c08f874dc5fe459d8c3e597d282208fcdbc8509dce99a732a496d94f07b
SHA5128885916165312ad30d16912b73e7a69d2ff3005e0b9a772163612b1b8766c6e5055ec063332be940fc626aacb0e1a42bdb2191ec6f5cef479dd40f6b9621b900
-
Filesize
99KB
MD5cb853d0e676be7b23903aa89175d8d69
SHA12066462d42c45133df60c5e5f9e8956373d191b0
SHA2567291b34528651c542a4e09036bb828f27c9f75c134d2be3aed3e1c5a0db5fe20
SHA512bf96f4c8511929ef380562004211a72821330465538db6da3367cbce387092384265e0bfd4ab54e62b742d68d668ff1457f43381d7a770fd3027f3bab1f36038
-
Filesize
1KB
MD5e6cfcbea2c7ff2e5c97aed4aed57f7dc
SHA15a1814ba21d62b4013bb047c9e545390613afeb7
SHA256803175cc505278eb96c2167c971eba5d8cb4bf5b62eefe1f26d0a7289415df88
SHA5124f0b883341d5bdc83647395c3b710de6b7d709a7ed247d36f5d8163382cf065222906682570a6ad9b86f97573f9d28c2b2fd5bd9a279ac2f4ce261e08317f360
-
Filesize
600B
MD5833a5a07c4cdebb628c1b2815b3bab94
SHA1a6b4faa0be2979174315daebab9f27ccc08dd26e
SHA2567a64bf7f1f37761f604e963cc6db464cf550f1dbf5ac70364b798c5336acb56b
SHA512bb1406a29fff7c1207fd0791ac0145c828b87c10f4ffe95a219763a390e865453c8804ee71d1159dee36855732605ea9ebc7acfb3c310bcb7972a2f24ff656be
-
Filesize
897B
MD50c5bd3da5b2a0f2f73beadc8a545400d
SHA1ce7effae7c511bf1f425ee84c0eb51d13a5e221f
SHA2560fa8229b45bcd1a9ad7c6e2b136891b90e3d2a5fe6a45daa04dcc2b3cd74ac2e
SHA512f21c2100a645c784fd7f2ab4e8b01dd866fd78133ab7c6690acadea298532fa38ca6a4c6cc310f3832895d6b87f6013fc3c45b608399246d39260b2c464523bc
-
Filesize
83KB
MD5f4ecd85cd2e28ae7b4c401e9ad94a98a
SHA1c32bd47698db3b3f9b0e86becc857d6e43d4eee3
SHA2567a86af02a370bc00d1cefad0040cc532d4fca661a9460d3c745e905af69a4f7e
SHA512aa97446a65bfdae9c8c38394bb3dd01d233bb508d75f57d62d5924bb72ab04f37ebe051d9507e2984fcf881d9ec163b77e2a16b1df15dc4ae89471e0e52594ed
-
Filesize
84KB
MD55170a55658e61a0773592f81c2da17ab
SHA166f6d8fe451139fe3f587c3fd97f1d95c5cfaec3
SHA2569405a72b4b1776d1d52e74ac431a7fd86e6217bfe640c62c949a631091dfd4a4
SHA51289957aa7b496d0a48e81578a82f48e2b828af7f9f80ae5acfa886c42034a7ede1de7121462aeb04cea108a1af2a6c90a0ddb81557c5a7dec62e9f8919c377ba1
-
Filesize
1024KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
112KB
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
1024KB