Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2024, 02:48

General

  • Target

    5253f7a06c69c8bed0eee411a7e0bb55.exe

  • Size

    39KB

  • MD5

    5253f7a06c69c8bed0eee411a7e0bb55

  • SHA1

    3a3f36e94ad74a700bc6d48a498773de192bec17

  • SHA256

    a6d0900830daa30ced5171f0c6863a235dc1b676c18924162758eb1baec8c605

  • SHA512

    6a0869c21f89c392c96a64f5899a59904b3bc5239e6c6852b16143d852eccdc00eab147e68bdf5886ead6afeb1ec68534d018b9b4b5f28ef068a026d838c6bc2

  • SSDEEP

    768:Rik+jTpwqPyR9qKARp1tgeWLikd0WwHj2c:RibCci9qXRrtgeWLikd62c

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5253f7a06c69c8bed0eee411a7e0bb55.exe
    "C:\Users\Admin\AppData\Local\Temp\5253f7a06c69c8bed0eee411a7e0bb55.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5253F7~1.EXE >> NUL
      2⤵
      • Deletes itself
      PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2816-5-0x0000000010000000-0x000000001000F000-memory.dmp

    Filesize

    60KB

  • memory/2816-6-0x0000000010000000-0x000000001000F000-memory.dmp

    Filesize

    60KB