Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 07:07 UTC

General

  • Target

    2cc1c56d3f26aa6bc7a036efbde4a9d3.exe

  • Size

    867KB

  • MD5

    2cc1c56d3f26aa6bc7a036efbde4a9d3

  • SHA1

    0e84dbd9743f10efa4221b747a38c5a1d291be47

  • SHA256

    449fd3e18ba5817154d52c59f5ba774f019a0e694b9278dc415998f5090c0587

  • SHA512

    24793f4055bb3c5eae1dac86cb0639e1fae0cb7344558f8e623b8a9ad71a9712b07964bf0e1aa85006346981899f3fc1a833cc02fbb4e2a8c108e5aedd59be63

  • SSDEEP

    24576:bsajHjIjzjbx72ItEbKBTy2WaBEMAfIGZJkUL:bns/x7HwKFPcZJR

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cc1c56d3f26aa6bc7a036efbde4a9d3.exe
    "C:\Users\Admin\AppData\Local\Temp\2cc1c56d3f26aa6bc7a036efbde4a9d3.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2408

Network

  • flag-us
    DNS
    soft-4download.com
    2cc1c56d3f26aa6bc7a036efbde4a9d3.exe
    Remote address:
    8.8.8.8:53
    Request
    soft-4download.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    soft-4download.com
    dns
    2cc1c56d3f26aa6bc7a036efbde4a9d3.exe
    64 B
    137 B
    1
    1

    DNS Request

    soft-4download.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2408-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-1-0x0000000002400000-0x0000000002440000-memory.dmp

    Filesize

    256KB

  • memory/2408-2-0x0000000002400000-0x0000000002440000-memory.dmp

    Filesize

    256KB

  • memory/2408-3-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-5-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-6-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-7-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2408-8-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-10-0x0000000002400000-0x0000000002440000-memory.dmp

    Filesize

    256KB

  • memory/2408-9-0x0000000002400000-0x0000000002440000-memory.dmp

    Filesize

    256KB

  • memory/2408-12-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2408-14-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-15-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-16-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-17-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-18-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-19-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-20-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-21-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-22-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-23-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-24-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

  • memory/2408-25-0x0000000000400000-0x0000000000A0E000-memory.dmp

    Filesize

    6.1MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.