Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2024, 19:14

General

  • Target

    4efcfc138874ab01932ba5741fc6f87b.exe

  • Size

    24KB

  • MD5

    4efcfc138874ab01932ba5741fc6f87b

  • SHA1

    91550ec50386ac6210b6d4fdc26b5333ccd2de5c

  • SHA256

    8411c715d28a942febfd7888b1544520d3a3f2eab7af50dc30c4042a7b5e22ba

  • SHA512

    01e1fb5e9e0549f6838eeb1692e0eafa3946ff0286db85ee4a1737b0afc4985e1615893195e84e847012d736153a5cb26c21ba9c21b129ca94cfa24408256044

  • SSDEEP

    384:E3eVES+/xwGkRKJ1b7lM61qmTTMVF9/q5a0:bGS+ZfbJ1fO8qYoAr

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4efcfc138874ab01932ba5741fc6f87b.exe
    "C:\Users\Admin\AppData\Local\Temp\4efcfc138874ab01932ba5741fc6f87b.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:2676
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:2392
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2800
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            4⤵
              PID:2592
          • C:\Windows\SysWOW64\NETSTAT.EXE
            netstat -an
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:2908

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        8KB

        MD5

        4d10f794036c3391acb1d378511c1be4

        SHA1

        d6941ed3971824db81095b4a60ffbd5b17ac7cd0

        SHA256

        832d054fd4663b91522273a584198f6edcf2e40e543ff45d9a92f12c4c9d6162

        SHA512

        1b95fd40ff905d187addaa8fb267d1f0500703d1ca49ee4686bde73aa5e5a8cc15523616ad04d9cac1d8360706ed241421c80d4b1272b9bf3a7a5b935e60e180