Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 13:45

General

  • Target

    3888729cc72b0d3366bbf63d3f765565.exe

  • Size

    196KB

  • MD5

    3888729cc72b0d3366bbf63d3f765565

  • SHA1

    d3459872b45e1d448da8843106e9d7398fd687e2

  • SHA256

    8c5e5458ea74f5605bed42d90f7b5bfbd128e66cf06b2afb018d6ccbabf1d232

  • SHA512

    3e9fef2dd0c3710c374ee96fa8fe63aa4054b8c586ec2cd5e17b68910dd43d2c3d2bc21777ccd87ff6407b5ee0b9c46dc38d9d3e04692caddf60d50bce09bde7

  • SSDEEP

    3072:pNfi7UDetE5KDMTN4khREkgMPcDNWt73c0/nZOZU8MeLBAkhVeiDWH:pNo85kkAkgMEDYCCn9PaD+

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3888729cc72b0d3366bbf63d3f765565.exe
    "C:\Users\Admin\AppData\Local\Temp\3888729cc72b0d3366bbf63d3f765565.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\3888729cc72b0d3366bbf63d3f765565.exe
      "C:\Users\Admin\AppData\Local\Temp\3888729cc72b0d3366bbf63d3f765565.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2448
  • C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
      2⤵
        PID:2800

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1700-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1700-10-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-17-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-16-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-18-0x0000000000460000-0x0000000000461000-memory.dmp

      Filesize

      4KB

    • memory/1700-13-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-3-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-5-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-22-0x0000000000470000-0x00000000004BF000-memory.dmp

      Filesize

      316KB

    • memory/1700-23-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-8-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/1700-1-0x0000000000400000-0x000000000044F000-memory.dmp

      Filesize

      316KB

    • memory/2500-6-0x0000000010E40000-0x0000000010E77000-memory.dmp

      Filesize

      220KB

    • memory/2500-0-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/2500-15-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB