Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
07/03/2024, 19:46
General
-
Target
b980145d888b56c6bf52c6c9332098ce.exe
-
Size
128KB
-
MD5
b980145d888b56c6bf52c6c9332098ce
-
SHA1
3b445171c8f5568d1b1c814870333c7813430b5e
-
SHA256
5152c064cd31273a82ce31e6ac60851b2c9f71d12f5251db3ca58f25edbeea6b
-
SHA512
64d8ef065988c0903f73822d003c696ec35f61b71c7f42131a38068c238c05c14333a9bf39d06140aa4df16cb809bfd3d70596963e83643c57a685344ca6ab54
-
SSDEEP
3072:rhY8WFCZbPwrjpl+8X3oOcMJ0OYNAKiJ37k:rhYGSf1X3vc83k
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b980145d888b56c6bf52c6c9332098ce.exe"C:\Users\Admin\AppData\Local\Temp\b980145d888b56c6bf52c6c9332098ce.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
16KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB