Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2024, 00:07

General

  • Target

    a0b352c83af0acd62f6f869e689c4ea7.exe

  • Size

    24KB

  • MD5

    a0b352c83af0acd62f6f869e689c4ea7

  • SHA1

    e2a5645f2e368332bf129c1a7c3372feef65ff5b

  • SHA256

    906e2b6f50b5b228174f20b45e614b80606589de602c1e2b49e0311ed73396c9

  • SHA512

    c5ec97e3396d4b9fed2ce6b55a7ceae3dd50bc2bc492efcc2d780187d6e323a852ada0de75b465368447b3c8c14031a412cc91512a9abe3a76a8eb091f8a386b

  • SSDEEP

    384:E3eVES+/xwGkRKJ3cZlM61qmTTMVF9/q5e80:bGS+ZfbJMZO8qYoAet

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe
    "C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:2224
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:2028
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1880
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            4⤵
              PID:2660
          • C:\Windows\SysWOW64\NETSTAT.EXE
            netstat -an
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:2628

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        8KB

        MD5

        20a619db8ec349f9675dd3dac3781171

        SHA1

        5549d1bb5b1ea0e0bc433940a823ada02a4e1a6f

        SHA256

        4d2f92be1db4e1b91cb5cd8bf2ee3594072d7e94432d98def534c3a3ae1f40e5

        SHA512

        21426d185bbaa6b03393b82526e2f6d25be8ed632316e79d67cec777da9ab96c78b02d713a215a9a35bd18cb203d9b606d4fa9dc0d18035a2af6fcba45eb478a