Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2024, 02:14

General

  • Target

    8a9bea061091cff92cd8de5c08ca9d33.exe

  • Size

    160KB

  • MD5

    8a9bea061091cff92cd8de5c08ca9d33

  • SHA1

    8a35f3f5395427f78f00d55e1b616a99a02820b1

  • SHA256

    bef79e59be13459d6095d9be063852a858b0bdb6db30946a2dbaf55cff7e81f2

  • SHA512

    82e4d6a5c9a5d006019da9fa5514e97153e5060dde299a88c49b49bd93c25ebf4e7588dfdda5e4fd91421e2b5756414a280e1a4cf153276d2e254145eb7ac0d6

  • SSDEEP

    3072:y+f72z/3ZRcuVtdJOJ91ax/bWtwMHEA1lYAMjMNZqm4wRo5gam5x+3gT:yv7HeGx/21kbYC7mo5gee

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a9bea061091cff92cd8de5c08ca9d33.exe
    "C:\Users\Admin\AppData\Local\Temp\8a9bea061091cff92cd8de5c08ca9d33.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1636-1-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1636-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1636-2-0x0000000000220000-0x0000000000224000-memory.dmp

    Filesize

    16KB

  • memory/1636-3-0x00000000002E0000-0x0000000000319000-memory.dmp

    Filesize

    228KB

  • memory/1636-5-0x0000000077A4F000-0x0000000077A50000-memory.dmp

    Filesize

    4KB

  • memory/1636-6-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

  • memory/1636-7-0x0000000000370000-0x0000000000380000-memory.dmp

    Filesize

    64KB

  • memory/1636-4-0x0000000077A50000-0x0000000077A51000-memory.dmp

    Filesize

    4KB

  • memory/1636-8-0x0000000076120000-0x0000000076230000-memory.dmp

    Filesize

    1.1MB

  • memory/1636-9-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1636-11-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/1636-10-0x0000000077A51000-0x0000000077A52000-memory.dmp

    Filesize

    4KB

  • memory/1636-14-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/1636-16-0x0000000077A88000-0x0000000077A89000-memory.dmp

    Filesize

    4KB

  • memory/1636-17-0x0000000010000000-0x0000000010013000-memory.dmp

    Filesize

    76KB

  • memory/1636-19-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1636-20-0x00000000002E0000-0x0000000000319000-memory.dmp

    Filesize

    228KB

  • memory/1636-21-0x0000000076120000-0x0000000076230000-memory.dmp

    Filesize

    1.1MB