Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 05:26

General

  • Target

    7f01121965b997f69eda48bbbfbd0092.exe

  • Size

    24KB

  • MD5

    7f01121965b997f69eda48bbbfbd0092

  • SHA1

    fd059dc8ef60657063c0cb0eb01444c5e028b779

  • SHA256

    eeef9bf4f1a02b52a39aa2d160040a6dda28983c66377dab6e69a6b390be7f43

  • SHA512

    0f9e691c7a39965d7ac8e8c4fbbc9a1303e0f9b1cea86292babeb532665e9811472b8e3cca76e4656eaece723e3be192391eae597f21573a3a0dda60688501f1

  • SSDEEP

    384:E3eVES+/xwGkRKJYklM61qmTTMVF9/q5A0:bGS+ZfbJYkO8qYoA5

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f01121965b997f69eda48bbbfbd0092.exe
    "C:\Users\Admin\AppData\Local\Temp\7f01121965b997f69eda48bbbfbd0092.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:2388
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:1964
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2536
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2644
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -an
          3⤵
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:2712
    • C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      1⤵
        PID:2660

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        8KB

        MD5

        b74ab44a9022a27eebf122a33cb79189

        SHA1

        2da846f3c3b60353dcb4de992fd135ec0b1f7877

        SHA256

        31d6b42ef6a51b463c0749805afa1adfa3a4c7d9169f4c58b9135667fb2e3150

        SHA512

        9edfd9bba7f2d63e31be0b2213c9016910ad2bf89773c894f0bdbd4a198b98d4bd3033ca70e6425af6a8aa9111a18d5c797c299dccdd674621aa5f8b98040483