Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

eb7ab3e66f...45.exe

windows7-x64

10

eb7ab3e66f...45.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    52s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2024, 18:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eb7ab3e66fad6d8ed5dd85a571e82545.exe

  • Size

    178KB

  • MD5

    eb7ab3e66fad6d8ed5dd85a571e82545

  • SHA1

    7c7297417a25592eccb1b8051ab91ad8488e11e7

  • SHA256

    2ca8e4b3919d58a54bbb210a2417144bf1b6885469ea98db4929bf8c5837d577

  • SHA512

    28dfe7da20b561c7d7c88551b00c46e740ecd774c3e9cc36d873dae8f45ce44e908a1c625f5d2ff42519144ee46903bbaf9f67677dd78f18a172d2e5cafab811

  • SSDEEP

    3072:xQCtdKoaJ1AnWlK9vYfKIgjagQLfNfb+k4R8j5a6bErEE3NihHwqOv7g:xQGjaMnWwwfKAfLf594R8bQF38

Score
10/10
evasion

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 26 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 6 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Modifies firewall policy service
    • Modifies security service
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:480
  • C:\Users\Admin\AppData\Local\Temp\eb7ab3e66fad6d8ed5dd85a571e82545.exe
    "C:\Users\Admin\AppData\Local\Temp\eb7ab3e66fad6d8ed5dd85a571e82545.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:2660
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \systemroot\Installer\{db46509d-5d12-1bd0-d886-080973d781e7}\@
    Filesize

    2KB

    MD5

    70206a18f87a6e3ebed36bc1db6665fa

    SHA1

    6d1b5ff48ad867087a816c6792b1bc4399c009a2

    SHA256

    08a6357e7b4f95074411ae44ddcde521c9c5725c16f36d0091b1be24326e90d3

    SHA512

    decfd0e0211aedc6e441305b731255e9484f70709e70f3e5c9411999a39639347d6e204fe1b96590ec955503b0fef2cca2b81552209295f06f939e28a3175cb8

    Download Submit

  • memory/480-9-0x00000000001C0000-0x00000000001CF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/480-13-0x00000000001C0000-0x00000000001CF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/480-27-0x00000000001D0000-0x00000000001DF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/480-18-0x00000000001D0000-0x00000000001DF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/480-19-0x00000000001D0000-0x00000000001DF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/480-17-0x00000000001C0000-0x00000000001CF000-memory.dmp

    Filesize

    60KB

    Download

  • memory/1192-6-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1868-2-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1868-5-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1868-1-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-4-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1868-23-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1868-25-0x0000000000220000-0x000000000024F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1868-26-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1868-3-0x0000000000220000-0x000000000024F000-memory.dmp

    Filesize

    188KB

    Download