Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01/01/2024, 17:46

General

  • Target

    file.exe

  • Size

    80KB

  • MD5

    8d9e7695b942e570f84564345d736762

  • SHA1

    e16022d7b4a5051c4bff6f8f23cf29ab0811c845

  • SHA256

    b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462

  • SHA512

    4031d726322cbb14ae84e60591d9c493495cf54e0028c86b3e1789b9885fce1fa577a47a5a1b5ca311b78e8b405f0d0149e44317d5e414d3e3e91d21dcf5f25f

  • SSDEEP

    1536:P3Mz85SRJP1sW7jeWkfp52S2QyS9QafFFUheeeeeeeeWeeeee:kw5gPiOjeDxb2QyS9QafFF

Malware Config

Signatures

  • Windows security bypass 2 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\syspolrvcs.exe
      C:\Windows\syspolrvcs.exe
      2⤵
      • Windows security bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Users\Admin\AppData\Local\Temp\290462860.exe
        C:\Users\Admin\AppData\Local\Temp\290462860.exe
        3⤵
        • Executes dropped EXE
        PID:2756
      • C:\Users\Admin\AppData\Local\Temp\2434528534.exe
        C:\Users\Admin\AppData\Local\Temp\2434528534.exe
        3⤵
        • Executes dropped EXE
        PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads