Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 03:02

General

  • Target

    0c64bc2a1c9496181e79c3aa75445b41.exe

  • Size

    1.7MB

  • MD5

    0c64bc2a1c9496181e79c3aa75445b41

  • SHA1

    80fd654d987bc9dec2fc17e2a505167c7ca55e94

  • SHA256

    5b210b801613f51262f0d2fcefdb5bfa57515b4b30cdced418eaf54a49c781d9

  • SHA512

    7e140679b6fbd15f94773a661ac59f40e2aad9aadce40778ff4d05ad24923d5da578f04561731b7652019a41fcbf41367f3c958cce13ede34ea2fea322eac4a8

  • SSDEEP

    49152:E6Puvkka04IgQcbGoCSw4EDnPiCLM3bhVPaS:8ZVLo2CF3b/

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe
    "C:\Users\Admin\AppData\Local\Temp\0c64bc2a1c9496181e79c3aa75445b41.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2668-1-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-2-0x0000000000FE0000-0x00000000014DB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-3-0x0000000000FE0000-0x00000000014DB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-5-0x0000000000FE0000-0x00000000014DB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-6-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-8-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-7-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-9-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-10-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-11-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-12-0x0000000000FE0000-0x00000000014DB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-13-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-14-0x0000000000FE0000-0x00000000014DB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-15-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-16-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-17-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-18-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-19-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-20-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-21-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-22-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-23-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-24-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-25-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB

  • memory/2668-26-0x0000000000400000-0x00000000008FB000-memory.dmp

    Filesize

    5.0MB