Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/02/2024, 16:22

General

  • Target

    8QPSTVLAC5IO8.exe

  • Size

    1.0MB

  • MD5

    618becc84857aecef7e13a08f1b2dcae

  • SHA1

    e5389cf14842defafb62f1e4319f7af46fc874a8

  • SHA256

    9672142f683a4994dd8ede46b537d11b65e9782423f35bf2b0dc435512bdf007

  • SHA512

    a355e394dba687ed7ccc376ae3c2472f3fb30f4cecc2dbdb36de1aa9137cb8e62c11ec5f645561a8a4ce38de1ff010f14e0eb850f9966fa5224742d7e75cb23a

  • SSDEEP

    24576:+WnFP2ey/3Y5gIfbGfdufw4oIGiX4J32OMmdiksSZiGJd8QV+FYC6kuJTZ/zbIde:wbYYCnwZLbQUO6

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe
    "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5
        3⤵
          PID:2448
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:2656
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:2416
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2576
            • C:\Windows\system32\certutil.exe
              certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5
              3⤵
                PID:2892
              • C:\Windows\system32\find.exe
                find /i /v "md5"
                3⤵
                  PID:3008
                • C:\Windows\system32\find.exe
                  find /i /v "certutil"
                  3⤵
                    PID:1952
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 1736 -s 1900
                  2⤵
                    PID:2544

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/1736-0-0x0000000036D10000-0x0000000036D20000-memory.dmp

                  Filesize

                  64KB