Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06/01/2024, 11:09
General
-
Target
bb4c4fe763e3a80945fc3f9617c981d3c7a9d48d9b6616e42c172884dc32102d.exe
-
Size
536KB
-
MD5
e8b3754676c5d5881fb0a08d84ca1367
-
SHA1
340dcf0227603e18fc25766db36961a486e7004f
-
SHA256
bb4c4fe763e3a80945fc3f9617c981d3c7a9d48d9b6616e42c172884dc32102d
-
SHA512
7f379744856c2f69bcf046e04f789b254606ca3ccebb8038d4c9a044c355f3969435b8d23c933eb4be71b8fa0a9c3afb4adea55228351d7c693582e970b9f9e8
-
SSDEEP
12288:chf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:cdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb4c4fe763e3a80945fc3f9617c981d3c7a9d48d9b6616e42c172884dc32102d.exe"C:\Users\Admin\AppData\Local\Temp\bb4c4fe763e3a80945fc3f9617c981d3c7a9d48d9b6616e42c172884dc32102d.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD501272566e40e4eaf22c2fa03da59da6a
SHA15fe5f26ad32a6770235dc22e56e1bccec0714584
SHA256bd920e09213c49a545d842d1deb4ca0541686dc6aed9aa9d33ef57e8bcf4c5e0
SHA5120e2566e442504c0b09622396ce1280ff4c8a5e32c38bb6b9c52d85dc8f1afba9cd064a58797e37614b946a1fae20176fe277ea6a40cc5003fce2f8a67fcd4c9d
-
Filesize
344B
MD540b5d87bd6c4881e92023c399b8e7485
SHA181063dd648b1c7f58be08c3cfa765495918b376b
SHA256cbdbbef9e2a84362a8e450ec0bfcdec6e06b4b96d2cb5244edf333c2f5abb99b
SHA512bbd9717c66668600ee933f06aeafd8331321a77de757b200adb87c557fd04ae35337228aaaaebb5f3af67e9635032b21697335bfc6dd9a5ef290259a27e66401
-
Filesize
344B
MD57410acc033a80fcc2a2ad4ba0a48fbe8
SHA124eb4f9e27bd3266d5cb472ac1ab28def21c1b62
SHA256a0c4681c65c804b79bd826a888d372dd9379e0f22667b0bf3ab19544b349aa8b
SHA512405ad09983bf9985381ca072f2d5c27c4b9fa069b9884a9662b7f0954c6be839cdebe6f31ed9ea8c36d72400fd0f5e96cbe790632c3a4bcfa2db2624e3376d87
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB