Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    167s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 04:04

General

  • Target

    27649f29d51de050582ec9ce2801d717.exe

  • Size

    317KB

  • MD5

    27649f29d51de050582ec9ce2801d717

  • SHA1

    439526cd194d97c252930ca8f1b03cdf60d6fa4b

  • SHA256

    b3d7b04dcbc104cec15b1f78c669cd2a7d897243b1330a81635feb451eca9dcc

  • SHA512

    34a018e65014b67efd5d804051a77d1b2772909ceae1780221b7ffa1a244758f65aa63cb8f9885c801ef6ee1a6e10dd6cfdc16f4e7b0b0242f758cca6cdcad83

  • SSDEEP

    6144:s2LcvFmaIdzZt0NMCfO09OBZuhECRiEcvC9DwyYZJ/wQglnDF:jL8F/Idz8mab+25c6NEJ/yF

Malware Config

Signatures

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27649f29d51de050582ec9ce2801d717.exe
    "C:\Users\Admin\AppData\Local\Temp\27649f29d51de050582ec9ce2801d717.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Modifies system certificate store
    PID:4088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4088-0-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-1-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-2-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-3-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-4-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-13-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-14-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-17-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB

  • memory/4088-20-0x0000000000650000-0x000000000070B000-memory.dmp

    Filesize

    748KB