Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/01/2024, 11:52
Behavioral task
behavioral1
Sample
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
Resource
win10v2004-20231215-en
General
-
Target
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
-
Size
274KB
-
MD5
642636ef75c52a44d3db2f3a947c826a
-
SHA1
1688459a0cf299aa696ea698ba1766ceb4746139
-
SHA256
6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97
-
SHA512
a7865497b3cb8dc701683e00a35956c737a4398359808281c3071831a90f45e3e249b8c57cbd1084a72c3ac15a00fe2277103595aed28a6e46ee9b051a9cce3a
-
SSDEEP
6144:tbTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:tPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3032-0-0x0000000000BD0000-0x0000000000C5C000-memory.dmp upx behavioral1/memory/3032-3-0x0000000000BD0000-0x0000000000C5C000-memory.dmp upx behavioral1/memory/3032-8-0x0000000000BD0000-0x0000000000C5C000-memory.dmp upx behavioral1/memory/3032-15-0x0000000000BD0000-0x0000000000C5C000-memory.dmp upx behavioral1/memory/3032-23-0x0000000000BD0000-0x0000000000C5C000-memory.dmp upx -
Unexpected DNS network traffic destination 7 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 223.5.5.5 Destination IP 114.114.114.114 Destination IP 223.5.5.5 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 223.5.5.5 Destination IP 114.114.114.114 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\err_3032.log 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3032 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe 3032 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe 3032 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3032 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe Token: SeTcbPrivilege 3032 6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe"C:\Users\Admin\AppData\Local\Temp\6f40bc1d868ddc2cc3cc0bc6aa3e61115dbd1e0b5e7cdb05d970d73cb2e92c97.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06