Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

e70b003d93...fc.exe

windows7-x64

7

e70b003d93...fc.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 12:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe

  • Size

    536KB

  • MD5

    bed29bb681d99164fe95fed1a02a7310

  • SHA1

    a02e64da076a1769361b4f7c2523ee0e012d4c5f

  • SHA256

    e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc

  • SHA512

    0284095b13bfe991f28f8cf63c006601c06b7f9257f3c8cbdb88418eb1ddd32259fe6678d4acff74c0cb6f6fa0e09d0b7ef36f2715cd0f2648ce892486ef4180

  • SSDEEP

    12288:phf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:pdQyDLzJTveuK0/Okx2LF

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe
      "C:\Users\Admin\AppData\Local\Temp\e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    2ba94c63c83e8033b9e02da3c8140ae0

    SHA1

    8c1440e0ceb97e1291633aea40a6487cf3238cc6

    SHA256

    89675bd767ae98e9aab33fe248721a6c384943d4f267b8148785306ef4663eb2

    SHA512

    355f7de88c56233c3e752ea8c3023e600397b51babe16d7bc964c8348ebc6797b651f3fa413a69f15906e2733d66c349bf51dd51c7bc34db16d0828696354dbd

    Download Submit

  • memory/1100-3-0x00000000024E0000-0x00000000024E3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1100-6-0x0000000003F00000-0x0000000003F79000-memory.dmp

    Filesize

    484KB

    Download

  • memory/1100-4-0x00000000024E0000-0x00000000024E3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1100-161-0x0000000003F00000-0x0000000003F79000-memory.dmp

    Filesize

    484KB

    Download

  • memory/1520-0-0x00000000009F0000-0x0000000000AF2000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1520-51-0x00000000009F0000-0x0000000000AF2000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1520-381-0x00000000009F0000-0x0000000000AF2000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1520-445-0x00000000009F0000-0x0000000000AF2000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1520-738-0x00000000009F0000-0x0000000000AF2000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1520-752-0x00000000009F0000-0x0000000000AF2000-memory.dmp

    Filesize

    1.0MB

    Download