Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

95cf89ceea...a2.rar

windows7-x64

3

95cf89ceea...a2.rar

windows10-2004-x64

7

Warm Snow ...er.exe

windows7-x64

1

Warm Snow ...er.exe

windows10-2004-x64

1

游侠网�...��.url

windows7-x64

1

游侠网�...��.url

windows10-2004-x64

1

游侠网�...��.url

windows7-x64

1

游侠网�...��.url

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Warm Snow v1.0-v20231205 Plus 15 Trainer.exe

  • Size

    1.9MB

  • MD5

    0c0a619fe74916c19c8db8cb94b63c35

  • SHA1

    eee29377b3baeb61ab963d34d166f69d04ace3ec

  • SHA256

    da18f76629df98da6c859fdda178f411ff3f05b326416a0994ae676cfd658e41

  • SHA512

    4a119c63118f01f77d411147b675ff9c4d367a485ee5c8d6d72c963c2f60a9c16041722d08c21ca87e90271cb8ae8ac869b1c11c23637ce60bd1b7cce1c15e50

  • SSDEEP

    49152:TmJeoncYOmlmJRGPlJeAp/nyxXT5XtzQx4I1:QmJMPl4D59z9I1

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Warm Snow v1.0-v20231205 Plus 15 Trainer.exe
    "C:\Users\Admin\AppData\Local\Temp\Warm Snow v1.0-v20231205 Plus 15 Trainer.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    2f6b460bdd883a05c35c29090d09c1d4

    SHA1

    29779fab06f5bde68bfcc4cc10ed62001e7419cb

    SHA256

    aa5d946ac82726a4a601eb174312d4278855b195b94205c8d3104297ed097116

    SHA512

    09cac98783e836d26462110e8d52b2cce188eb97ca8561a5b7181d471b10cc1e69633ba8f1ac829d5d4e11080fa4077bb6cc8778f9bd7da3acf22daef21883b0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    53c5eca6ed9bf9efef9f2bd497d32060

    SHA1

    9330e7177f06a2bfc0091a6204c778ed0e65d9b0

    SHA256

    1903d9139f463d9832402baecbf2b7c14ac2c2561357d865ae907e9d640414ee

    SHA512

    5be8bf6d8d07e63094f66ff2da959ee5ac101e3f814e072cacb45ab6eed3511da6ebc368c4840f9970bd6638fd83c78b7082d3a5527b49d430b9828916b3b5f3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    40b678ce353700a519e5157bb833711a

    SHA1

    afe10299c88c737cd878b31d61abe5c992cd3c40

    SHA256

    0eedac6c9260cbda5b0ec1c682407d100c08ec532660a65545c5623513593a66

    SHA512

    ec83231a34311d2e327f143606d69295c35012e5756965a1defaf74da2c4834fda56a966d7fbc27b62caff0f9b2d3438461e89cf7360a1da141a71c0e07f7ecb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab32A4.tmp
    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar3401.tmp
    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    Download Submit

  • memory/2964-4-0x0000000001D40000-0x0000000001D4A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2964-6-0x000000001B0C0000-0x000000001B140000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2964-10-0x000000001B0C0000-0x000000001B140000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2964-0-0x0000000001C80000-0x0000000001CB4000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2964-5-0x0000000001D40000-0x0000000001D4A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2964-2-0x000000001B0C0000-0x000000001B140000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2964-3-0x000000001B0C0000-0x000000001B140000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2964-1-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2964-142-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2964-143-0x0000000001D40000-0x0000000001D4A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2964-144-0x0000000001D40000-0x0000000001D4A000-memory.dmp

    Filesize

    40KB

    Download