Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2024, 10:51

General

  • Target

    abb46444054b7fa13ad3b1279b328969.exe

  • Size

    22KB

  • MD5

    abb46444054b7fa13ad3b1279b328969

  • SHA1

    22fc3cb36605a8a08563c4ff217a9e7288474194

  • SHA256

    d9b20243128608b90703af34197b18c37aa64401cae65d5f76442d0b3ea38283

  • SHA512

    6aa69ae25f06cff4ba628b28db506a26f0ce78ebde42ed9c399af916b8398359c39797080a3bd78e5dba5c74613dbd03710442745dc421332196afaade16c1bb

  • SSDEEP

    384:nRI5PCiTQBjY2sWTXDMozA7cPeEEw7sGzyjMsuYlkIJwPjVJ3hxinzJwAkJ9:WClK21Uoz6C/qjTuYGIJgjVJXZAkf

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abb46444054b7fa13ad3b1279b328969.exe
    "C:\Users\Admin\AppData\Local\Temp\abb46444054b7fa13ad3b1279b328969.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\dat1D12.tmp

    Filesize

    14KB

    MD5

    de66c830cd1b082e6551022bebcf1c9b

    SHA1

    6470a3e71ae4e9f31862e88b66a96496cf87b93d

    SHA256

    17b627d224870c7616fef96f509862c9aad45912dec2c875616e3b52f16e52a2

    SHA512

    a7b669457b177b5675260e06a4a48f2d81bc84973c4eb4d13056587e70d8cdef86cedb9179be2cf02b20e91207a0bda9c989055d29905da9237d29c3ccc18584

  • memory/2344-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2344-6-0x0000000010000000-0x000000001001A000-memory.dmp

    Filesize

    104KB

  • memory/2344-10-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB