Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2024, 13:55

General

  • Target

    ADR.exe

  • Size

    793KB

  • MD5

    22d15da443d9ce05bd4db542c671bdc2

  • SHA1

    31e2ee1c02b7aa2af5b17301bb5c8a4c80bf4291

  • SHA256

    c409ed66a84e3a1cc0754dd156676a0e4152c343b288f2bb01d49f8987c4418f

  • SHA512

    bac757ef777be13f6d4d15d90c3c824d6299c1773550be0c73c07f39eb7bf3207649f906bffa74c723172e9010774a2cb32d14486896a310f4a1781cc18866a9

  • SSDEEP

    24576:JDFELvaut+qaRb9xxR3UROireiB67MP+h2X6C:hK+BleTyiBth6C

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ADR.exe
    "C:\Users\Admin\AppData\Local\Temp\ADR.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2344-0-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-1-0x00000000002E0000-0x0000000000310000-memory.dmp

    Filesize

    192KB

  • memory/2344-36-0x0000000002560000-0x0000000002561000-memory.dmp

    Filesize

    4KB

  • memory/2344-63-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/2344-62-0x0000000002960000-0x0000000002961000-memory.dmp

    Filesize

    4KB

  • memory/2344-61-0x0000000002840000-0x0000000002841000-memory.dmp

    Filesize

    4KB

  • memory/2344-60-0x0000000002810000-0x0000000002811000-memory.dmp

    Filesize

    4KB

  • memory/2344-59-0x0000000002820000-0x0000000002821000-memory.dmp

    Filesize

    4KB

  • memory/2344-58-0x00000000027F0000-0x00000000027F1000-memory.dmp

    Filesize

    4KB

  • memory/2344-57-0x0000000002800000-0x0000000002801000-memory.dmp

    Filesize

    4KB

  • memory/2344-56-0x00000000027D0000-0x00000000027D1000-memory.dmp

    Filesize

    4KB

  • memory/2344-55-0x00000000027E0000-0x00000000027E1000-memory.dmp

    Filesize

    4KB

  • memory/2344-54-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2344-53-0x0000000002790000-0x0000000002791000-memory.dmp

    Filesize

    4KB

  • memory/2344-52-0x00000000027A0000-0x00000000027A1000-memory.dmp

    Filesize

    4KB

  • memory/2344-51-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/2344-50-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2344-49-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/2344-48-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/2344-47-0x00000000025F0000-0x00000000025F1000-memory.dmp

    Filesize

    4KB

  • memory/2344-46-0x0000000002600000-0x0000000002601000-memory.dmp

    Filesize

    4KB

  • memory/2344-45-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/2344-44-0x00000000025E0000-0x00000000025E1000-memory.dmp

    Filesize

    4KB

  • memory/2344-43-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2344-42-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/2344-41-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/2344-40-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/2344-39-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/2344-38-0x0000000002580000-0x0000000002581000-memory.dmp

    Filesize

    4KB

  • memory/2344-37-0x0000000002270000-0x0000000002271000-memory.dmp

    Filesize

    4KB

  • memory/2344-35-0x0000000002250000-0x0000000002251000-memory.dmp

    Filesize

    4KB

  • memory/2344-34-0x0000000002260000-0x0000000002261000-memory.dmp

    Filesize

    4KB

  • memory/2344-33-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB

  • memory/2344-32-0x0000000002200000-0x0000000002201000-memory.dmp

    Filesize

    4KB

  • memory/2344-31-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB

  • memory/2344-30-0x00000000021E0000-0x00000000021E1000-memory.dmp

    Filesize

    4KB

  • memory/2344-29-0x00000000021B0000-0x00000000021B1000-memory.dmp

    Filesize

    4KB

  • memory/2344-28-0x00000000021C0000-0x00000000021C1000-memory.dmp

    Filesize

    4KB

  • memory/2344-27-0x0000000002190000-0x0000000002191000-memory.dmp

    Filesize

    4KB

  • memory/2344-26-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/2344-25-0x0000000002170000-0x0000000002171000-memory.dmp

    Filesize

    4KB

  • memory/2344-24-0x0000000002180000-0x0000000002181000-memory.dmp

    Filesize

    4KB

  • memory/2344-23-0x0000000002030000-0x0000000002031000-memory.dmp

    Filesize

    4KB

  • memory/2344-22-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/2344-21-0x0000000002000000-0x0000000002001000-memory.dmp

    Filesize

    4KB

  • memory/2344-20-0x0000000002020000-0x0000000002021000-memory.dmp

    Filesize

    4KB

  • memory/2344-19-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

    Filesize

    4KB

  • memory/2344-18-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

    Filesize

    4KB

  • memory/2344-17-0x0000000000690000-0x0000000000691000-memory.dmp

    Filesize

    4KB

  • memory/2344-16-0x0000000000930000-0x0000000000931000-memory.dmp

    Filesize

    4KB

  • memory/2344-15-0x0000000000670000-0x0000000000671000-memory.dmp

    Filesize

    4KB

  • memory/2344-14-0x0000000000680000-0x0000000000681000-memory.dmp

    Filesize

    4KB

  • memory/2344-13-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/2344-12-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB

  • memory/2344-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2344-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2344-9-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2344-8-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2344-7-0x0000000000390000-0x0000000000391000-memory.dmp

    Filesize

    4KB

  • memory/2344-6-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2344-5-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2344-4-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2344-3-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2344-2-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2344-161-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-163-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-164-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-166-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-167-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-168-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-169-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-170-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-171-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-172-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-173-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-174-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-175-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB

  • memory/2344-176-0x0000000000400000-0x000000000054C000-memory.dmp

    Filesize

    1.3MB