Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 20:15

General

  • Target

    1ba2d64ff7d998f96db7657b9ebd307b.exe

  • Size

    423KB

  • MD5

    1ba2d64ff7d998f96db7657b9ebd307b

  • SHA1

    d2d048a2320930c520f52f870bc9c210f30ff38c

  • SHA256

    efbb014d82aef853b10a2b8de542c04981cec30ae705f62a5b6b2202b08aa2ce

  • SHA512

    e53579b4ea6a668d86ee064b608b056ec2c81580ecd524796d6f3d6ba77205c0c3174624e4ec91eca469f80b8301efe488b165cea4d07b351ac0e501da22fb66

  • SSDEEP

    6144:oxJ61E0Fg0C7pzNZT3KUDEeuH4RU0yDaytuxcz7TPUhKuh9EOSTsoSS6v:oxgvC79NZTaGuwiuxu7Tkf9E9TsoSr

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ba2d64ff7d998f96db7657b9ebd307b.exe
    "C:\Users\Admin\AppData\Local\Temp\1ba2d64ff7d998f96db7657b9ebd307b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\GetRightToGo\1ba2d64ff7d998f96db7657b9ebd307b.data

    Filesize

    582B

    MD5

    1999ed7fc05ac1e7644b6fb7f067542d

    SHA1

    2f8f001dabc376e06190ab8316ad1663bd30038a

    SHA256

    063751312d5e1991e7925dfa575497de5ab6fbd9b73d16bcc7b5a2fa833fb792

    SHA512

    df63328ebd2b7c29b3a0febaff706d0046303ba20001e52d5a1ab71e6fe8eeb42f1802d939a14ae9865d84b7d9f57b894deb34c3418127383b028c77dcecf35f

  • memory/2444-0-0x0000000000400000-0x0000000000541000-memory.dmp

    Filesize

    1.3MB

  • memory/2444-9-0x0000000000400000-0x0000000000541000-memory.dmp

    Filesize

    1.3MB

  • memory/2444-11-0x0000000000400000-0x0000000000541000-memory.dmp

    Filesize

    1.3MB