Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28/02/2024, 10:51
General
-
Target
abb46444054b7fa13ad3b1279b328969.exe
-
Size
22KB
-
MD5
abb46444054b7fa13ad3b1279b328969
-
SHA1
22fc3cb36605a8a08563c4ff217a9e7288474194
-
SHA256
d9b20243128608b90703af34197b18c37aa64401cae65d5f76442d0b3ea38283
-
SHA512
6aa69ae25f06cff4ba628b28db506a26f0ce78ebde42ed9c399af916b8398359c39797080a3bd78e5dba5c74613dbd03710442745dc421332196afaade16c1bb
-
SSDEEP
384:nRI5PCiTQBjY2sWTXDMozA7cPeEEw7sGzyjMsuYlkIJwPjVJ3hxinzJwAkJ9:WClK21Uoz6C/qjTuYGIJgjVJXZAkf
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: LoadsDriver 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abb46444054b7fa13ad3b1279b328969.exe"C:\Users\Admin\AppData\Local\Temp\abb46444054b7fa13ad3b1279b328969.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5de66c830cd1b082e6551022bebcf1c9b
SHA16470a3e71ae4e9f31862e88b66a96496cf87b93d
SHA25617b627d224870c7616fef96f509862c9aad45912dec2c875616e3b52f16e52a2
SHA512a7b669457b177b5675260e06a4a48f2d81bc84973c4eb4d13056587e70d8cdef86cedb9179be2cf02b20e91207a0bda9c989055d29905da9237d29c3ccc18584
-
Filesize
52KB
-
Filesize
104KB
-
Filesize
52KB