Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/01/2024, 12:23

General

  • Target

    462609f6b5dd85cef27d4c6f4bdef415acb8456fb43c67fb529b734d6c8e207e.exe

  • Size

    1.9MB

  • MD5

    c2cf72d4c6612f51e99d596c114c8722

  • SHA1

    0c2a24cb35ba7a4addcdacdf2681d71a70d2e4f7

  • SHA256

    462609f6b5dd85cef27d4c6f4bdef415acb8456fb43c67fb529b734d6c8e207e

  • SHA512

    267dc6792eaac665c292446e2fcaab6a912ca78cc29ef867ba437a770c61fe2888c3e7be50de2b16cb1fd36c2e217b54414d880b04419d49c45a48459ddc15b7

  • SSDEEP

    49152:h4RihqjLqxUimYU0ecdY6+Ag+Z1ZkKWlmM+E8EB2Y:hOihk+tecdd+ARZanr2Y

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\462609f6b5dd85cef27d4c6f4bdef415acb8456fb43c67fb529b734d6c8e207e.exe
    "C:\Users\Admin\AppData\Local\Temp\462609f6b5dd85cef27d4c6f4bdef415acb8456fb43c67fb529b734d6c8e207e.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2104-0-0x0000000000400000-0x00000000008D7000-memory.dmp

    Filesize

    4.8MB

  • memory/2104-1-0x0000000000AA0000-0x0000000000AD0000-memory.dmp

    Filesize

    192KB

  • memory/2104-23-0x0000000002680000-0x0000000002681000-memory.dmp

    Filesize

    4KB

  • memory/2104-65-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

    Filesize

    4KB

  • memory/2104-64-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

    Filesize

    4KB

  • memory/2104-63-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

  • memory/2104-62-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

    Filesize

    4KB

  • memory/2104-61-0x0000000002A70000-0x0000000002A71000-memory.dmp

    Filesize

    4KB

  • memory/2104-60-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/2104-59-0x0000000002A50000-0x0000000002A51000-memory.dmp

    Filesize

    4KB

  • memory/2104-58-0x0000000002A60000-0x0000000002A61000-memory.dmp

    Filesize

    4KB

  • memory/2104-57-0x0000000002A30000-0x0000000002A31000-memory.dmp

    Filesize

    4KB

  • memory/2104-56-0x0000000002A40000-0x0000000002A41000-memory.dmp

    Filesize

    4KB

  • memory/2104-55-0x0000000002A10000-0x0000000002A11000-memory.dmp

    Filesize

    4KB

  • memory/2104-54-0x0000000002A20000-0x0000000002A21000-memory.dmp

    Filesize

    4KB

  • memory/2104-53-0x00000000029F0000-0x00000000029F1000-memory.dmp

    Filesize

    4KB

  • memory/2104-52-0x0000000002A00000-0x0000000002A01000-memory.dmp

    Filesize

    4KB

  • memory/2104-51-0x00000000029D0000-0x00000000029D1000-memory.dmp

    Filesize

    4KB

  • memory/2104-50-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/2104-49-0x00000000029B0000-0x00000000029B1000-memory.dmp

    Filesize

    4KB

  • memory/2104-48-0x00000000029C0000-0x00000000029C1000-memory.dmp

    Filesize

    4KB

  • memory/2104-47-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/2104-46-0x00000000029A0000-0x00000000029A1000-memory.dmp

    Filesize

    4KB

  • memory/2104-45-0x0000000002970000-0x0000000002971000-memory.dmp

    Filesize

    4KB

  • memory/2104-44-0x0000000002980000-0x0000000002981000-memory.dmp

    Filesize

    4KB

  • memory/2104-43-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/2104-42-0x0000000002960000-0x0000000002961000-memory.dmp

    Filesize

    4KB

  • memory/2104-41-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/2104-40-0x0000000002940000-0x0000000002941000-memory.dmp

    Filesize

    4KB

  • memory/2104-39-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/2104-38-0x0000000002920000-0x0000000002921000-memory.dmp

    Filesize

    4KB

  • memory/2104-37-0x00000000028F0000-0x00000000028F1000-memory.dmp

    Filesize

    4KB

  • memory/2104-36-0x0000000002900000-0x0000000002901000-memory.dmp

    Filesize

    4KB

  • memory/2104-35-0x00000000028D0000-0x00000000028D1000-memory.dmp

    Filesize

    4KB

  • memory/2104-79-0x0000000000400000-0x00000000008D7000-memory.dmp

    Filesize

    4.8MB

  • memory/2104-34-0x00000000028E0000-0x00000000028E1000-memory.dmp

    Filesize

    4KB

  • memory/2104-33-0x0000000002820000-0x0000000002821000-memory.dmp

    Filesize

    4KB

  • memory/2104-32-0x00000000028C0000-0x00000000028C1000-memory.dmp

    Filesize

    4KB

  • memory/2104-31-0x0000000002800000-0x0000000002801000-memory.dmp

    Filesize

    4KB

  • memory/2104-30-0x0000000002810000-0x0000000002811000-memory.dmp

    Filesize

    4KB

  • memory/2104-29-0x00000000026E0000-0x00000000026E1000-memory.dmp

    Filesize

    4KB

  • memory/2104-28-0x00000000026F0000-0x00000000026F1000-memory.dmp

    Filesize

    4KB

  • memory/2104-27-0x00000000026C0000-0x00000000026C1000-memory.dmp

    Filesize

    4KB

  • memory/2104-26-0x00000000026D0000-0x00000000026D1000-memory.dmp

    Filesize

    4KB

  • memory/2104-25-0x00000000026A0000-0x00000000026A1000-memory.dmp

    Filesize

    4KB

  • memory/2104-24-0x00000000026B0000-0x00000000026B1000-memory.dmp

    Filesize

    4KB

  • memory/2104-22-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

  • memory/2104-21-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/2104-20-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/2104-19-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2104-18-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/2104-17-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

    Filesize

    4KB

  • memory/2104-16-0x0000000002320000-0x0000000002321000-memory.dmp

    Filesize

    4KB

  • memory/2104-15-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

    Filesize

    4KB

  • memory/2104-14-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

    Filesize

    4KB

  • memory/2104-13-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

    Filesize

    4KB

  • memory/2104-12-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

    Filesize

    4KB

  • memory/2104-11-0x0000000000B90000-0x0000000000B91000-memory.dmp

    Filesize

    4KB

  • memory/2104-10-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

    Filesize

    4KB

  • memory/2104-9-0x0000000000B60000-0x0000000000B61000-memory.dmp

    Filesize

    4KB

  • memory/2104-8-0x0000000000A70000-0x0000000000A71000-memory.dmp

    Filesize

    4KB

  • memory/2104-7-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2104-6-0x0000000000B50000-0x0000000000B51000-memory.dmp

    Filesize

    4KB

  • memory/2104-5-0x0000000002B20000-0x0000000002B2B000-memory.dmp

    Filesize

    44KB

  • memory/2104-4-0x0000000000A80000-0x0000000000A81000-memory.dmp

    Filesize

    4KB

  • memory/2104-3-0x0000000000A90000-0x0000000000A94000-memory.dmp

    Filesize

    16KB

  • memory/2104-2-0x0000000010000000-0x000000001001E000-memory.dmp

    Filesize

    120KB