Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 17:48

General

  • Target

    c93c1de83b8b943ee6a26713d8b689e5.exe

  • Size

    23KB

  • MD5

    c93c1de83b8b943ee6a26713d8b689e5

  • SHA1

    c6a9fd7c5a2926d9d3d127fa4af1d28df3154f51

  • SHA256

    78c05f6ef92fc7364ca05be348c752e8eb94c478c5f39dbe046e7e41cdfc9ec1

  • SHA512

    355ce868fe04b0289e908161c63f8d85f797ba6e91e434bacc021293c9acdacdbd44cb07cb19faaa47e088a59e4e84967db1ebbe317e3f4133e5fec0a8171d78

  • SSDEEP

    384:nDZEcDXBS4RupdKyqYDsDUXr1lIywySi3cRVT8jcwGr:DZDRStpnTsQzcv8jPO

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c93c1de83b8b943ee6a26713d8b689e5.exe
    "C:\Users\Admin\AppData\Local\Temp\c93c1de83b8b943ee6a26713d8b689e5.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ad0c6c65ada82f158904135661aeaa74

    SHA1

    b3d8c085d2749c5e02f68686dcce46824bcecaba

    SHA256

    8766e9274106ca944b6cb8b07efcf0b491730bdb570ffe20574d5082bbd38180

    SHA512

    2789058265a0ee1bf620586150d4f30f5a95a61ab8fef4a59c135a6ad5031745e308a002bf7f90d8da312571a6d529deaf37f868cf6df7bdf30d5490c9aeedc7

  • C:\Users\Admin\AppData\Local\Temp\Cab82B9.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar9527.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • C:\Users\Admin\AppData\Local\Temp\~!#33EF.tmp

    Filesize

    11KB

    MD5

    4cc04d79fa1893dc60e7c1b3df05894a

    SHA1

    1bcc75c0ce5181527129ace000a694fc4f0bba75

    SHA256

    2cae27eda1ffbf9c0edddd265308f6be76a1a0c4b1b0627de50c270ed8fbaa3b

    SHA512

    d5d6a4518f5f9047576b701b40bce14a2bbb6c936067b356d0b3d54249a24280d47c63c61a5f47423718fd12e3f8e9aba1763cde7db8ef964849bea61cac11a2

  • C:\Users\Admin\AppData\Local\Temp\~!#46FE.tmp

    Filesize

    9KB

    MD5

    b13ac35d8b13f7d0cbb7bf2196a0914a

    SHA1

    7d5bb6cc15cb23ad0ae49b9fdaac12d4e2d69ad4

    SHA256

    011f04bcdc0d0bf2fd7a9f518966ed934787649d6070c3a42cd71c2d50cc8a44

    SHA512

    6b4b2acb849aebe3b631fc60d6db295428cb055409c23df467eaa5660e53fc44b076ae5eba567fb622f5c9673231dfaa0efaac2c919afe10989deaa1e2b63b52

  • C:\Users\Admin\AppData\Local\Temp\~!#72B.tmp

    Filesize

    9KB

    MD5

    f7b3ce7fc9d46135ce51464b6073e7f8

    SHA1

    19c1801898ca8662bc32020e3ae8d4a98acd04c1

    SHA256

    3bada61ecefd084db9933d560dd8446ecef93150181e7b9eabea366f52e31aaa

    SHA512

    81247e701b8292915575d568316d28081c80a85a89c957df42f7823de8d4071c177bd776f0be2ee045b5f251c230e49ab10de0881d5e63179726410ead2e5c2e

  • C:\Users\Admin\AppData\Local\Temp\~!#8AE4.tmp

    Filesize

    6KB

    MD5

    ebfb5f358645df38f609e74d99d30700

    SHA1

    5e72f33b817ec82bc4388cced18b439efebca08b

    SHA256

    966efa0238c676515e539cc5b3bab2017808ea70797503df99c6444303f98abb

    SHA512

    aedaf0ce5840d473075d91c323d75b64a50122f02e7afef9091d5d580681b19ddcef37628fa1f991dea7520f3d742126ba934eac6c836ca8414de5fedb217753

  • C:\Users\Admin\AppData\Local\Temp\~!#8EBE.tmp

    Filesize

    4KB

    MD5

    f887ad830ae23aa49e58deaffd00b784

    SHA1

    33b9a142a66440f3f031ad204e3497ee8702d1a0

    SHA256

    bc0be93a80e956ac273987158e683ff81466677b0e0cbe459c0b72aada2d3c78

    SHA512

    1b70c91b4775a0f959b2f87973be5fda33b889f1d2d7b359d72af0617a6df488507e5cebf270dbd66993ea2438d1cf1345f3e3eebc8be4bc13fec50d6f55dc01

  • C:\Users\Admin\AppData\Local\Temp\~!#8FB9.tmp

    Filesize

    13KB

    MD5

    08f7c7cd56c2a532fd0f452a28949b5b

    SHA1

    50d515f170d70eb4becf34aae02c95a08655d8d2

    SHA256

    5bed16183a13dfd25821d7be8ea9917d45b7e03f04d822e042f016ac3d32580c

    SHA512

    26a720c2bbd5d87d884ba2522dbdefc04d97cdfba893e65f10c0b686de472ec9a01d61fdf9e48a8d98b970e36543d6928953330224b0a1e1703ef4ba438dacbd

  • C:\Users\Admin\AppData\Local\Temp\~!#9DE1.tmp

    Filesize

    10KB

    MD5

    4014b1952c988f6075e37595c552cbbb

    SHA1

    cb016c6138d16e03d80d3d446dd1286e1decb496

    SHA256

    9bc65228aebfa471288c2d10bb7e6eac4ae202985adeeccc37f714ba3cede5f3

    SHA512

    a89b9437529a11547680006b4fb931bf536db1086637443c953ff2511ce9df1fb2fd8fbad846264c5ebd94af699692822033598028acd3bd1c44325c9cd5a7a0

  • memory/2464-112-0x0000000000240000-0x0000000000242000-memory.dmp

    Filesize

    8KB

  • memory/2464-0-0x0000000000240000-0x0000000000242000-memory.dmp

    Filesize

    8KB