Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2024, 10:31

General

  • Target

    Bolt AIO CRACKED BY [TZCRACKING]/Bolt AIO CRACKED BY [TZCRACKING].exe

  • Size

    922KB

  • MD5

    727188832e9d77e87ebd1aaa12105638

  • SHA1

    0a547ad642b712ab92a189acc776d3758ba163bb

  • SHA256

    567b8af881787af693a08f8c0849d104ea1427e65c5275e554346a40c44bb219

  • SHA512

    5cf2ff673614718723f15d7201c6292fe8be0d24cdd9b2bd210c8155049b2e3045ae4e05be9f09deeafb04d3d4e690696750413576cd675a33d2a85484d36dd8

  • SSDEEP

    24576:GF4fE2pLTyWeFtPtFt6WxWFTxkt6WxWFTxZ:eYLT2rlrj

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bolt AIO CRACKED BY [TZCRACKING]\Bolt AIO CRACKED BY [TZCRACKING].exe
    "C:\Users\Admin\AppData\Local\Temp\Bolt AIO CRACKED BY [TZCRACKING]\Bolt AIO CRACKED BY [TZCRACKING].exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2868
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2372
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\New Text Document.txt
      1⤵
        PID:2784

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Documents\New Text Document.txt

        Filesize

        42B

        MD5

        e8a5485e570ab67708edab32db23f8c2

        SHA1

        fa8073114fbf53d7d92155334ea00af004a8f22f

        SHA256

        61499beed72c4e9b94fdb9b8299b89f84043648718498601e30463c60d9bbedd

        SHA512

        9ffb1a370edd7df3ea58ae6416b91df9d241e0091df228c5958d1b9114b2f7e81ebae58a7d39707ac736af225e683ce39dbb07b0e38f3e6f50ab387bb7d3ccc0

      • memory/2784-16-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/2868-8-0x0000000009B30000-0x0000000009BE0000-memory.dmp

        Filesize

        704KB

      • memory/2868-11-0x000000000ADD0000-0x000000000ADD2000-memory.dmp

        Filesize

        8KB

      • memory/2868-4-0x0000000000720000-0x0000000000734000-memory.dmp

        Filesize

        80KB

      • memory/2868-5-0x0000000004C80000-0x0000000004CC0000-memory.dmp

        Filesize

        256KB

      • memory/2868-6-0x0000000004C80000-0x0000000004CC0000-memory.dmp

        Filesize

        256KB

      • memory/2868-7-0x00000000046D0000-0x00000000046EA000-memory.dmp

        Filesize

        104KB

      • memory/2868-0-0x0000000000D00000-0x0000000000DEC000-memory.dmp

        Filesize

        944KB

      • memory/2868-9-0x000000000A2A0000-0x000000000A3A0000-memory.dmp

        Filesize

        1024KB

      • memory/2868-10-0x000000000AD90000-0x000000000AD91000-memory.dmp

        Filesize

        4KB

      • memory/2868-3-0x0000000004AD0000-0x0000000004C1E000-memory.dmp

        Filesize

        1.3MB

      • memory/2868-12-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2868-13-0x0000000004C80000-0x0000000004CC0000-memory.dmp

        Filesize

        256KB

      • memory/2868-14-0x000000000A2A0000-0x000000000A3A0000-memory.dmp

        Filesize

        1024KB

      • memory/2868-15-0x000000000AD90000-0x000000000AD91000-memory.dmp

        Filesize

        4KB

      • memory/2868-2-0x0000000004C80000-0x0000000004CC0000-memory.dmp

        Filesize

        256KB

      • memory/2868-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2868-21-0x0000000000A50000-0x0000000000A76000-memory.dmp

        Filesize

        152KB