Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/02/2024, 20:29

240217-y9yzpabb28 10

17/02/2024, 20:20

240217-y4ry7aba54 7

Analysis

  • max time kernel
    148s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    17/02/2024, 20:20

General

  • Target

    $PLUGINSDIR/app-64.7z

  • Size

    80.0MB

  • MD5

    3ee37c0a040d01b12c017d5910d9d2a0

  • SHA1

    4722278c4de0742dcbaf92bbc73a1b0ecb44ab4a

  • SHA256

    0b749b5d1a9c699ddb5fec5ffd600ba7ca15f410e54bc6bc5f2f834f69a46cb4

  • SHA512

    6ad9ce42b0f0f0d2740b7899aaf776214f0ead4f649957e457150db38442f9a03d44ad74d7e60c59c4d38de57442cde360d3ce15bb05fee5d9fad87ab59f4ab5

  • SSDEEP

    1572864:ab+n6npC5ZhWkKV0mxFee1STuEWSzPGZq5xGGmG6qcK2V78QrOptItrjYpT:aSn6npCokE0O1STuEWSCZqfGGdTtQrOR

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads