Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 00:55
General
-
Target
093735edf11dac4f8ec9a7c61d959ad6.exe
-
Size
195KB
-
MD5
093735edf11dac4f8ec9a7c61d959ad6
-
SHA1
8eec2dde0b66f59fd6cc2206d9b6f3511c46689a
-
SHA256
00d785bad69f12e0838413acebeb6bf9b1784a9d004b61698b27c69f6b174bdc
-
SHA512
4ea6a46568c45be21f7393bf2160afc0ec2e7b9b7f6b2fc0d8d300cc9d3dde58e2aca1d3faede156fadbda8d3534eec010fc766352f3fac15aab709be69de1df
-
SSDEEP
6144:AE06JW+MfwCQUkyBDsQprPSkrRUdKB5Ki45QlcN:AF6bMjmyBAGbX2Yf45YcN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\093735edf11dac4f8ec9a7c61d959ad6.exe"C:\Users\Admin\AppData\Local\Temp\093735edf11dac4f8ec9a7c61d959ad6.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\0853.bat" "2⤵
-
-
C:\Users\Admin\ttfjfb.exe\u2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD5749c8765b2efd0d8d70ba482ef579338
SHA12c18d44f941c94eaa8cf80818ca2130383b84980
SHA256133eec83386d62a921b921a786b08f62471f5fb1c5a321fba621338fd57ef05b
SHA512a80d04fd045c785b0d5d340efbbfec335fa9412258c813809d4033de8a5f825d78fc97a80b827f2fbe5fc437020009d9a77af96c824d81e754a036aef0be8ba8
-
Filesize
18KB
MD537a74e95fd4ecaaa3048e1f05dc55280
SHA1d8bc42cb8b9c04a9b993f7b98b43251d107bff59
SHA256dfbe244d8100090dcac04b6f254381f2a322814281f27b1ac1da326634421f83
SHA512337de5a38fff8dc2ee46d7c68fa5afbd50e69154d446ddad7acabe0270c56d1bd26146151922a804990b12f3ab983ebe6f747d947135cfb1ceb9e83fbe5e2530
-
Filesize
44KB
MD5d3e60058140956006eb1b5fc7a16aadb
SHA1859ce6612957d444c4799aadc96053db929ce2f9
SHA2560d441d98d8e1e0406a7794a96378a73aa6c052f32192efabc77a1c3ab72578ec
SHA5124daf8640316aa30519b05aee4697ebd941688acfbd9f719bdcdb3377ab4cd16acd7b83b6d746c7a67cfa60e13413b78e50af5d9a1e4eadd7313c699047da9982
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB