Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14/01/2024, 22:23
General
-
Target
88b0e395af46237cc4e747d6fb72b66cb13c3ebb79e744f207c5220d82098c2a.exe
-
Size
414KB
-
MD5
53440afc9cd1ef21a952ecb0e71d2d41
-
SHA1
9ac171a2aa9d18c05e1cf2384dd0ec5f550898c4
-
SHA256
88b0e395af46237cc4e747d6fb72b66cb13c3ebb79e744f207c5220d82098c2a
-
SHA512
89f81df4d4358d2b97e804f73f95fc04450f716ea50c4f0c896f0df1295af30f0ebce4b3adbe193b42c118fb246e04ffb1bb689d6b31b776d4527d3412800632
-
SSDEEP
6144:5/nyPhSrJKNFAnQyGCeuXkJOldxZJVnoSFHiSOrpyYR3dPI:5/ny5gKNjEEJOldxZJySFCNr7PI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88b0e395af46237cc4e747d6fb72b66cb13c3ebb79e744f207c5220d82098c2a.exe"C:\Users\Admin\AppData\Local\Temp\88b0e395af46237cc4e747d6fb72b66cb13c3ebb79e744f207c5220d82098c2a.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DefendSecurity\SecurityHealthService.ScanC:\ProgramData\DefendSecurity\SecurityHealthService.Scan -ExEc Bypass -Command "& {&('i'+'ex') (gc -Raw -Path 'C:\pRogRaMdatA\lH6gEw462770nr1F7u0UreGjd00tSJv0Rt6g0mOL8hri4y37gXHMYI7R2.brk')}"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462KB
MD5852d67a27e454bd389fa7f02a8cbe23f
SHA15330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB