Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 12:08

General

  • Target

    faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe

  • Size

    56KB

  • MD5

    086481522ddd73d2511991cb48f92078

  • SHA1

    69faca9c790519234f3b6509b0528531175319f4

  • SHA256

    c53eff8e80c2e3ab0d228a3905e846200869fb57d83e10eee0b4f08d167ce397

  • SHA512

    8bb0681980701bb9ae02cb606ef0bb5e7d862beb4313994a81ceddeaaf97843d992c33c4b700ad4c844deae99d6854d930c515b3eb4013bdecf9c7c93eb402f3

  • SSDEEP

    1536:OHK+ZHaTXNZOxpZTy1IsTTm84rzr1YM9FoIv3:OHpRaT+plyGsTTl61HPv3

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe
    "C:\Users\Admin\AppData\Local\Temp\faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\rlfsz.exe

    Filesize

    56KB

    MD5

    086481522ddd73d2511991cb48f92078

    SHA1

    69faca9c790519234f3b6509b0528531175319f4

    SHA256

    c53eff8e80c2e3ab0d228a3905e846200869fb57d83e10eee0b4f08d167ce397

    SHA512

    8bb0681980701bb9ae02cb606ef0bb5e7d862beb4313994a81ceddeaaf97843d992c33c4b700ad4c844deae99d6854d930c515b3eb4013bdecf9c7c93eb402f3

  • \Windows\SysWOW64\lqpti.dll

    Filesize

    8KB

    MD5

    a1a4b157a63b8a4e9632a2116abd7924

    SHA1

    8f6596bd069425c56dd69af9a5ef68fa6eb7ad06

    SHA256

    cb42f1c3e73dc00eff229011b72eb1cf7ba06d78dc455ab1151a4439ab07a192

    SHA512

    824ebb0163d6a7cee521a2d775564c2f6ed6b8cd70d418178c89b6efb9cea2624bb6d4f5dc8753bf031c14fbd4aef6d76c25b337f40b67e816adcdd5e5c5400f

  • memory/2672-0-0x0000000000500000-0x000000000050C000-memory.dmp

    Filesize

    48KB

  • memory/2672-4-0x0000000075000000-0x0000000075007000-memory.dmp

    Filesize

    28KB

  • memory/2672-10-0x0000000075000000-0x0000000075007000-memory.dmp

    Filesize

    28KB