Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2024, 16:41

General

  • Target

    4bf04e6b1c367f4beebeddf4c91a923e.exe

  • Size

    537KB

  • MD5

    4bf04e6b1c367f4beebeddf4c91a923e

  • SHA1

    a95b05d787a1627849fee3bbf03ccdbef98260d8

  • SHA256

    33df3c9644961a47680d842248dad9e2aedbe9e7344c5499ffe56dd688ebbb9f

  • SHA512

    c58218088fbe2a85619a23649e9594f23d3d4d85f2cc961d07b8ef59b1fe7d1fcad8f9dd8364b35e0a4e40cf34d4f8c6155bfde24f038d5d1f121840bc1dc708

  • SSDEEP

    12288:DbhRToCzj8Q0L0yVXZKPGFbtmUrHjOYNlY38S/A+3S:DbnTbnyVJKcZZHjTNOXA6S

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bf04e6b1c367f4beebeddf4c91a923e.exe
    "C:\Users\Admin\AppData\Local\Temp\4bf04e6b1c367f4beebeddf4c91a923e.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\UNINSTAL.BAT
      2⤵
      • Deletes itself
      PID:456
  • C:\Windows\360safe.exe
    C:\Windows\360safe.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:3008

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\360safe.exe

      Filesize

      537KB

      MD5

      4bf04e6b1c367f4beebeddf4c91a923e

      SHA1

      a95b05d787a1627849fee3bbf03ccdbef98260d8

      SHA256

      33df3c9644961a47680d842248dad9e2aedbe9e7344c5499ffe56dd688ebbb9f

      SHA512

      c58218088fbe2a85619a23649e9594f23d3d4d85f2cc961d07b8ef59b1fe7d1fcad8f9dd8364b35e0a4e40cf34d4f8c6155bfde24f038d5d1f121840bc1dc708

    • C:\Windows\UNINSTAL.BAT

      Filesize

      186B

      MD5

      7e0f9d10bfe62f20ababca814960313a

      SHA1

      e5635136c2468c8ae8d40f52f342bc7e2cbde2e9

      SHA256

      c02aff02cbdfb4a35ec29d7ab38a2672f7220f0ac6a722df32d429bdb7577a65

      SHA512

      7768d0a2a824d1ad3c8ec8d4ebd85dea650d56c35b19b046e8d7ee5ebacf05099224817cb846f4f38b0cde91d4512a377b9e4c74cf0a34aa45bdf51ad8a1ca37

    • memory/2152-0-0x0000000000400000-0x00000000005A2000-memory.dmp

      Filesize

      1.6MB

    • memory/2152-2-0x0000000000380000-0x00000000003CB000-memory.dmp

      Filesize

      300KB

    • memory/2152-15-0x00000000028B0000-0x00000000028B1000-memory.dmp

      Filesize

      4KB

    • memory/2152-17-0x00000000022F0000-0x00000000022F1000-memory.dmp

      Filesize

      4KB

    • memory/2152-20-0x0000000002740000-0x0000000002741000-memory.dmp

      Filesize

      4KB

    • memory/2152-19-0x0000000002450000-0x0000000002451000-memory.dmp

      Filesize

      4KB

    • memory/2152-35-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

      Filesize

      4KB

    • memory/2152-65-0x0000000002D10000-0x0000000002D11000-memory.dmp

      Filesize

      4KB

    • memory/2152-64-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

      Filesize

      4KB

    • memory/2152-63-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

      Filesize

      4KB

    • memory/2152-62-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

      Filesize

      4KB

    • memory/2152-61-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

      Filesize

      4KB

    • memory/2152-60-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

      Filesize

      4KB

    • memory/2152-59-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

      Filesize

      4KB

    • memory/2152-58-0x0000000002C80000-0x0000000002C81000-memory.dmp

      Filesize

      4KB

    • memory/2152-57-0x0000000002C90000-0x0000000002C91000-memory.dmp

      Filesize

      4KB

    • memory/2152-56-0x0000000002C60000-0x0000000002C61000-memory.dmp

      Filesize

      4KB

    • memory/2152-55-0x0000000002C00000-0x0000000002C01000-memory.dmp

      Filesize

      4KB

    • memory/2152-54-0x0000000002C10000-0x0000000002C11000-memory.dmp

      Filesize

      4KB

    • memory/2152-53-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

      Filesize

      4KB

    • memory/2152-52-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

      Filesize

      4KB

    • memory/2152-51-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

      Filesize

      4KB

    • memory/2152-50-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

      Filesize

      4KB

    • memory/2152-49-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

      Filesize

      4KB

    • memory/2152-48-0x0000000002B60000-0x0000000002B61000-memory.dmp

      Filesize

      4KB

    • memory/2152-47-0x0000000002B70000-0x0000000002B71000-memory.dmp

      Filesize

      4KB

    • memory/2152-46-0x0000000002B80000-0x0000000002B81000-memory.dmp

      Filesize

      4KB

    • memory/2152-45-0x0000000002B40000-0x0000000002B41000-memory.dmp

      Filesize

      4KB

    • memory/2152-44-0x0000000002B20000-0x0000000002B21000-memory.dmp

      Filesize

      4KB

    • memory/2152-43-0x0000000002B30000-0x0000000002B31000-memory.dmp

      Filesize

      4KB

    • memory/2152-42-0x0000000002B00000-0x0000000002B01000-memory.dmp

      Filesize

      4KB

    • memory/2152-41-0x0000000002B10000-0x0000000002B11000-memory.dmp

      Filesize

      4KB

    • memory/2152-40-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

      Filesize

      4KB

    • memory/2152-39-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

      Filesize

      4KB

    • memory/2152-38-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

      Filesize

      4KB

    • memory/2152-34-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/2152-33-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

      Filesize

      4KB

    • memory/2152-32-0x0000000002A80000-0x0000000002A81000-memory.dmp

      Filesize

      4KB

    • memory/2152-31-0x0000000002A90000-0x0000000002A91000-memory.dmp

      Filesize

      4KB

    • memory/2152-30-0x0000000002960000-0x0000000002961000-memory.dmp

      Filesize

      4KB

    • memory/2152-29-0x0000000002970000-0x0000000002971000-memory.dmp

      Filesize

      4KB

    • memory/2152-28-0x0000000002940000-0x0000000002941000-memory.dmp

      Filesize

      4KB

    • memory/2152-27-0x0000000002950000-0x0000000002951000-memory.dmp

      Filesize

      4KB

    • memory/2152-26-0x0000000002920000-0x0000000002921000-memory.dmp

      Filesize

      4KB

    • memory/2152-25-0x0000000002930000-0x0000000002931000-memory.dmp

      Filesize

      4KB

    • memory/2152-24-0x0000000002900000-0x0000000002901000-memory.dmp

      Filesize

      4KB

    • memory/2152-23-0x0000000002910000-0x0000000002911000-memory.dmp

      Filesize

      4KB

    • memory/2152-22-0x00000000028F0000-0x00000000028F1000-memory.dmp

      Filesize

      4KB

    • memory/2152-21-0x00000000025B0000-0x00000000025B1000-memory.dmp

      Filesize

      4KB

    • memory/2152-18-0x0000000002500000-0x0000000002501000-memory.dmp

      Filesize

      4KB

    • memory/2152-16-0x00000000023A0000-0x00000000023A1000-memory.dmp

      Filesize

      4KB

    • memory/2152-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

      Filesize

      4KB

    • memory/2152-13-0x0000000000290000-0x0000000000291000-memory.dmp

      Filesize

      4KB

    • memory/2152-12-0x00000000028A0000-0x00000000028A1000-memory.dmp

      Filesize

      4KB

    • memory/2152-11-0x00000000028E0000-0x00000000028E1000-memory.dmp

      Filesize

      4KB

    • memory/2152-10-0x0000000002340000-0x0000000002341000-memory.dmp

      Filesize

      4KB

    • memory/2152-9-0x0000000002310000-0x0000000002311000-memory.dmp

      Filesize

      4KB

    • memory/2152-8-0x0000000002890000-0x0000000002893000-memory.dmp

      Filesize

      12KB

    • memory/2152-7-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

    • memory/2152-6-0x0000000002380000-0x0000000002381000-memory.dmp

      Filesize

      4KB

    • memory/2152-5-0x0000000002350000-0x0000000002351000-memory.dmp

      Filesize

      4KB

    • memory/2152-4-0x0000000002390000-0x0000000002391000-memory.dmp

      Filesize

      4KB

    • memory/2152-3-0x0000000002370000-0x0000000002371000-memory.dmp

      Filesize

      4KB

    • memory/2152-1-0x0000000000290000-0x0000000000291000-memory.dmp

      Filesize

      4KB