Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
07/01/2024, 00:14
General
-
Target
4787553d83d6cb1d17d817b29c3f0d2e.exe
-
Size
365KB
-
MD5
4787553d83d6cb1d17d817b29c3f0d2e
-
SHA1
d8ab6d46a89385b31780ca78ffc2445c1c8de3d4
-
SHA256
6042378e770691c0c6c1c80ed5807be567f37a3c8608d3027996aa9fe369dc7d
-
SHA512
36ff0afabed4cb36a5c481df10449513dd21171b1d680e438961e4f153fc7dc9d74f6b7c858cf84a877d34905e1352deb803f8cfe2839edcb5892d400d1d2c2e
-
SSDEEP
6144:0bq+bIZrZL+TnqRTMdDVJJ8pnXunpWH3rF2dWVOfis9yMdnWFJ0htBuNhRI:T+IZQrqRAdD+pXunQ7F2djdIJ0ht6k
Malware Config
Signatures
-
Windows security bypass 2 TTPs 10 IoCs
-
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe"C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD544d4f7f20686ba39077f7a5ab977f3ca
SHA186d58b04b300c2c3a37b024314a96825d4e63e6a
SHA2568bbfc423aa2780f1b9054d4ea171c71f213989248fdd923882043f0c8977a156
SHA512a1ba5aaebc2caaac6f9c121efcc1f99661706f226c344fcba0de8b3ba9ad7118e56798f64a8815cee05a22e786cdd9633acf3f4c9491537ab5fe11b87db4d6cf
-
Filesize
90KB
MD575031416d9e0e7fb02a5a26fcfd35438
SHA1e5e2fbcd9fca5d12f885aa06c23a9e5b8a45622d
SHA2567c9c491cf98f08f77301f9d2616fda3564a6658f43ac12d1e0e678035d1c2e20
SHA5124c029ae761cded412ce247f0f338818bcfd91086df860339911c8995db5d428ace53c31099a6e72274452b4818c8cd53511f15fbd2aae40c548ad39770251cde
-
Filesize
1KB
MD5841b69102e698d5eed7911c374d2d37f
SHA1e3e1ae1337892c4e5779d0db4343c7c007fca8f3
SHA256a580b0d9e621e05a2871f2278ee4098b35b68b98f013a2a8f6c57d66155bddca
SHA5122d1e0725201d45337300d7183640e6819e48539a96972d765e6642377c1a871c5c0ea8db05e7bc6b689d9b7cd35fff5c5475b991be26bde5f01b72572ff7e54c
-
Filesize
71KB
MD520e6691800b5b8514c7f22275b8986e9
SHA1a63dda7eea8eb106f5dacfed0d0d40ef422dc45f
SHA256f870d481ea8a247c453fa160937f99f66ea2ca8094c112848e9d3e8bb0cd4876
SHA5128b24e357c1007bbf32afb975e5f79ab7a6cc31979785f6a84b61c08eb3dc30bdb28eec354b051ca12c25316db767b548380fe42ff1c218e4a76d35217e5f992c
-
Filesize
52KB
MD5a6582e724c91f74842e46cbfee234d1f
SHA1e2a5bfbe0fc8968c196901defdf162972f871dbd
SHA256db4c0f8a48dbaf2690aceab44108f7cf7a80daab9edbb376578175ccc6d1a5ff
SHA512847ddd4d02253a924f202b495c29e8b9ce2f66c0f2f53356385357cfd63bbc094a4fe84ac1dffe133fb5af2d9b57fcb0bfa5973973e6e09e9ad56a6c9bc59dc6
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB