Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/03/2024, 19:12

240305-xwl8asff85 6

05/03/2024, 19:09

240305-xts8tsff45 6

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 19:09

General

  • Target

    N00bs Account Generator/N00bAccountGen.exe

  • Size

    9KB

  • MD5

    f6da01bf90fa70802582829e872772ef

  • SHA1

    571cde44d8604d0e3fac00f0ad76776db695b3fb

  • SHA256

    91ce8eebd837be4cfb13fac9fb570ca03b3e449033586a392804093824f050b7

  • SHA512

    99a8fce7e587991924533e051b96eb27b179df1288717a2cd2711bcda71ff50c7730bd1a70ab6f707e4a25a03477bdce1c62e5839865c5081a32e31fdc7be319

  • SSDEEP

    96:lVvB5JtI3o32KybnE20qyAqHM9I1zm+W+H1ciaTGHpSdA1p1f3H6eGlzNt:lLObYbsWhmP+HWioSoAFfLGf

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\N00bs Account Generator\N00bAccountGen.exe
    "C:\Users\Admin\AppData\Local\Temp\N00bs Account Generator\N00bAccountGen.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\Local\Temp\TarC337.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • memory/2364-0-0x00000000002C0000-0x00000000002C8000-memory.dmp

    Filesize

    32KB

  • memory/2364-1-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB

  • memory/2364-2-0x0000000000330000-0x0000000000358000-memory.dmp

    Filesize

    160KB

  • memory/2364-3-0x00000000007A0000-0x00000000007E0000-memory.dmp

    Filesize

    256KB

  • memory/2364-4-0x00000000007A0000-0x00000000007E0000-memory.dmp

    Filesize

    256KB

  • memory/2364-5-0x0000000074D90000-0x000000007547E000-memory.dmp

    Filesize

    6.9MB