Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

winprofile

windows7-x64

1

winprofile

windows10-1703-x64

8

Analysis

  • max time kernel
    291s
  • max time network
    295s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-en
  • resource tags

    arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/03/2024, 01:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d.exe

  • Size

    2.7MB

  • MD5

    b08df6fcf8a6d7b7cae9fe77137476a5

  • SHA1

    21de94d07adabcd45f68ad8461fd94b435e058cb

  • SHA256

    d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d

  • SHA512

    1b164328fee82717fd9cb0eb12ff2ee46192129b2de272f795755533a8e430d05679c34bbe7beb7634a7ed547f703dea24b98c4dc80395c7b28abfb15d9f085e

  • SSDEEP

    49152:YlJ3+cr+d2KM8KQ8RRGVJu6kiGoMil7YQgoF9Gz4NFGov/++do:e3KMiEC9G0NFGov/++

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d.exe
    "C:\Users\Admin\AppData\Local\Temp\d5a7ba6406e166dc583859bdebddca764662b8fa6ebd967e70181aef231d0f0d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:292
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1496
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
    Filesize

    985B

    MD5

    b8099e86ab03d38c4a1301676ed2400e

    SHA1

    0cc677acda9b3243c91e29588e398b977945b4ee

    SHA256

    6f04c5344bffccabd7aa38504bee1fb64ea7de322a3b362f0418306052a9d884

    SHA512

    a02dbc9b65d032077c190a6fad9c83c1b9ed3500a4b782e20e72f14e755f1ccb3ee04d95944294b0007adf2f3acd6e68fedf21f6dc6cbd86c79f4334451c07d7

    Download Submit

  • memory/1496-7-0x0000000001420000-0x0000000001421000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3364-0-0x00000000022F0000-0x000000000234D000-memory.dmp

    Filesize

    372KB

    Download

  • memory/3364-4-0x0000000000560000-0x0000000000561000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3852-14-0x00000263A5320000-0x00000263A5340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3852-16-0x00000263A54A0000-0x00000263A54C0000-memory.dmp

    Filesize

    128KB

    Download