Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/01/2024, 14:28

General

  • Target

    175e9d378894af2b863a9f23c498a70a43f5d67d59362b59a26c86f4187d6397.exe

  • Size

    3.8MB

  • MD5

    e786188a4f43098a58d9614aecc86743

  • SHA1

    2c3858b2f8d72634f42929f2e56a362d1d02aa44

  • SHA256

    175e9d378894af2b863a9f23c498a70a43f5d67d59362b59a26c86f4187d6397

  • SHA512

    61c3813f259a9baa3c8db6b34680682c4c088666071b24a018a8601895250c8aea22848359c6e337e7d40588d3083ee98dd4f98286f49df2d5cfb30f9c854c96

  • SSDEEP

    98304:6AejIUQM1NIhJ2wJyPGhMAUu6Ve0xxiZU8:Drw8r8AXl0xMZ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies system certificate store 2 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\175e9d378894af2b863a9f23c498a70a43f5d67d59362b59a26c86f4187d6397.exe
    "C:\Users\Admin\AppData\Local\Temp\175e9d378894af2b863a9f23c498a70a43f5d67d59362b59a26c86f4187d6397.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Modifies system certificate store
    PID:1204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\Local\Temp\Cab4DA5.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar4DE7.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Users\Admin\AppData\Local\Temp\{2A8466AD-494F-421e-AA4B-CE627AC8449A}.tmp\360NetUL.dll

    Filesize

    237KB

    MD5

    e965ae5ece45e7951050fbd4c8e6dfa1

    SHA1

    7dbac716a97758652fcd0c64c3a058e0b23e3b58

    SHA256

    57da4c2a9b303cdbef17a9937a983a67ea9d32f8c7474077f300bedb03887520

    SHA512

    0ab2108de1614fcc066a4e5982368ad39145b6aa1b073969f859bfe47440b876fd8b48dcdf986b6359d67701e6c3bb080745d78fec82f37e29c64a4daa8cc367

  • \Users\Admin\AppData\Local\Temp\{DAFCEE01-26A1-41f2-BB08-DF25F741054E}.tmp\7z.dll

    Filesize

    1.1MB

    MD5

    510b4fb31400e4d222dda77e4ebaa734

    SHA1

    722672630d14fb58388bb571417786210a969c86

    SHA256

    43ab16e268342796e773b516c6062db70d04fea647ec5a63199ce5c4f125f9ad

    SHA512

    592cabeac8046d6811f5d37858c9370b929efa6a10180e9d5bc702eba01429d12c47b808efe7013ba4918591ae25a2134a0dfa4a8842f80a8b34d675fbb5ea11

  • memory/1204-86-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/1204-87-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB