Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
13/02/2024, 02:30
General
-
Target
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe
-
Size
843KB
-
MD5
a194de24dfbba6afe8153b8a7d593e7e
-
SHA1
dd9e65550462722c10a07a6018ddc3fade4b1406
-
SHA256
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b
-
SHA512
4f702036655b07112ccd9effc1602b92e1ec08edfe32a3ff649423a0ee6cc9a7897fb1404c13a3569e1bf1cd3d9d341d5f179038bb4c3f769c4472feb5567e20
-
SSDEEP
24576:yxYS04YNEMuExDiU6E5R9s8xY/2l/dqLc83oIbt+ri:yxA4auS+UjfU2TAt3oIbt+r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe"C:\Users\Admin\AppData\Local\Temp\1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
821KB
MD5999ee84f3d506e3413c8fa2d2b6e1eee
SHA11153f10ed80cdbc93bec3780cf9dc909ba724b68
SHA256b2b51bd33016357130f7bc420a439963af8d95e57b42788e1e3bb7fdf46c1d1b
SHA51280c369e87a8fae3734889f2628a4c80bb7e97ddf40a51ce6a7a0d71fdb0b1cc3d5059dc4444e1536e69575ed692356c70bc6308bfa53f0a7bf51c66b3e9ca996
-
Filesize
843KB
MD5a194de24dfbba6afe8153b8a7d593e7e
SHA1dd9e65550462722c10a07a6018ddc3fade4b1406
SHA2561a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b
SHA5124f702036655b07112ccd9effc1602b92e1ec08edfe32a3ff649423a0ee6cc9a7897fb1404c13a3569e1bf1cd3d9d341d5f179038bb4c3f769c4472feb5567e20
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
872KB
-
Filesize
304KB
-
Filesize
312KB
-
Filesize
32KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
872KB