Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 20:42

General

  • Target

    03737b0acc09c43872f87b72f8a48108.exe

  • Size

    277KB

  • MD5

    03737b0acc09c43872f87b72f8a48108

  • SHA1

    36b6ac40d57ae7ecb5753d5b43fc58e4a7fa7109

  • SHA256

    7dfaf7dcb5e4a600c2dde4f2627dda36a2e5afdf8c41d077a9eeb2ca8a40bc93

  • SHA512

    3c0753e763ed94a153953d760079a315bee00f21de5f906400afa8aa748d2c57056db72fb1c9668e4bea92e0412b5c3fe0e7dda78cccaebd8270dd1e1d727b27

  • SSDEEP

    6144:aV1VjlMindSC/xSAZ21ICSFjmf9fWDCxS2K0naW+tIqlnlkka:a1jlMiSGxBUVSFmf9fx2G4eu6r

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03737b0acc09c43872f87b72f8a48108.exe
    "C:\Users\Admin\AppData\Local\Temp\03737b0acc09c43872f87b72f8a48108.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2088-0-0x00000000005D0000-0x0000000000637000-memory.dmp

    Filesize

    412KB

  • memory/2088-1-0x0000000000400000-0x0000000000555000-memory.dmp

    Filesize

    1.3MB

  • memory/2088-5-0x0000000001FF0000-0x00000000020A2000-memory.dmp

    Filesize

    712KB

  • memory/2088-9-0x0000000001FF0000-0x00000000020A2000-memory.dmp

    Filesize

    712KB

  • memory/2088-13-0x0000000001FF0000-0x00000000020A2000-memory.dmp

    Filesize

    712KB

  • memory/2088-11-0x0000000001FF0000-0x00000000020A2000-memory.dmp

    Filesize

    712KB

  • memory/2088-7-0x0000000001FF0000-0x00000000020A2000-memory.dmp

    Filesize

    712KB

  • memory/2088-3-0x0000000001FF0000-0x00000000020A2000-memory.dmp

    Filesize

    712KB

  • memory/2088-14-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-18-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-16-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-42-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-49-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-53-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-55-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-59-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-66-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-67-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-75-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-83-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-86-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-85-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-84-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-82-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-81-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-80-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-79-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-78-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-77-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-76-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-74-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-73-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-72-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-71-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-70-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-69-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-68-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-65-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-64-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-63-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-62-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-61-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-60-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-58-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-57-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-56-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-54-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-52-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-51-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-50-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-48-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-47-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-46-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-45-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-44-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-43-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-41-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-40-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB

  • memory/2088-904-0x00000000005D0000-0x0000000000637000-memory.dmp

    Filesize

    412KB

  • memory/2088-1034-0x0000000000400000-0x0000000000555000-memory.dmp

    Filesize

    1.3MB

  • memory/2088-1286-0x0000000002540000-0x00000000025F8000-memory.dmp

    Filesize

    736KB