Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 22:33

General

  • Target

    c7053bdef48425f6bd01b2a33aa63cab.exe

  • Size

    38KB

  • MD5

    c7053bdef48425f6bd01b2a33aa63cab

  • SHA1

    c5b73cdd845cbc94c127c67bb8d6eda75ece2d9c

  • SHA256

    817d9a8b5805b7a06b488db7f43d42529b9814936ced55a66b15687b1c58e94e

  • SHA512

    22bca871fb8ef4976152fab30ec9e79f607a02ec3ed251749ee7a792b6906e860c503f522bd56b40458e31efc3ee9f002a63d745e79eb6da67357da832e4c7dd

  • SSDEEP

    768:cvCsiQNghYML057aeoaMxNTjQsVuZLmFL5FYNwGfowjuWKGz1:cvCQ4057hoaMxNHXVaLmLGAqjLp

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7053bdef48425f6bd01b2a33aa63cab.exe
    "C:\Users\Admin\AppData\Local\Temp\c7053bdef48425f6bd01b2a33aa63cab.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Sets file execution options in registry
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2792-3-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2792-12-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB