Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 20:18

General

  • Target

    8d4026927e63b4f57f0cf29c9b533eae.exe

  • Size

    12.3MB

  • MD5

    8d4026927e63b4f57f0cf29c9b533eae

  • SHA1

    f4cf91a6416fb107e18df48b467ed188ad058db9

  • SHA256

    069ff67f9dd8ce03ffe71958852da3cfd59adbb5d5094f499d155f9e7b61d62d

  • SHA512

    5c3fb03e3e566936d173fe3912e9c01003cb1cb635d0b4d6dc34ce29d3a865016d759a25a8bc4e39d75746f1ec70fc42c80894cb598dac057dc0597f750d20fe

  • SSDEEP

    393216:uoJcTniUayxkDMBswCdv2IxqT3exAICSIO1:9+TniURGYwRYD2

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d4026927e63b4f57f0cf29c9b533eae.exe
    "C:\Users\Admin\AppData\Local\Temp\8d4026927e63b4f57f0cf29c9b533eae.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic BaseBoard get SerialNumber
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2264-0-0x0000000000400000-0x0000000001B3E000-memory.dmp

    Filesize

    23.2MB

  • memory/2264-28-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2264-30-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2264-25-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2264-23-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2264-20-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2264-40-0x0000000000370000-0x0000000000371000-memory.dmp

    Filesize

    4KB

  • memory/2264-38-0x0000000000370000-0x0000000000371000-memory.dmp

    Filesize

    4KB

  • memory/2264-41-0x0000000000400000-0x0000000001B3E000-memory.dmp

    Filesize

    23.2MB

  • memory/2264-42-0x0000000077170000-0x0000000077171000-memory.dmp

    Filesize

    4KB

  • memory/2264-36-0x0000000000370000-0x0000000000371000-memory.dmp

    Filesize

    4KB

  • memory/2264-35-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2264-33-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2264-31-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2264-18-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2264-15-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2264-13-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2264-10-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2264-8-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2264-6-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2264-5-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2264-3-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2264-1-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2264-47-0x0000000000400000-0x0000000001B3E000-memory.dmp

    Filesize

    23.2MB