Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 17:03

General

  • Target

    WizWorm.exe

  • Size

    14.3MB

  • MD5

    ee37a918d746512afa8e35109f6d8b85

  • SHA1

    f98359a420af803fb7ba9941ea719dad39bea2a7

  • SHA256

    02f104af2be304ea240158bfb8200ed782884a3eeadcaee50e706849651ee08f

  • SHA512

    db80db4bf2094d33824078e876b23a3374929663cfe83eed507f2029910a2ae5d32b8f38aaca3b54a15c1148ae8e2b7ed706bdadfdf4a6dfc7f8a94f97ab1160

  • SSDEEP

    393216:83vfM+4cdgLNLmpDz05h8HpCLemOEkHh1og2CrVJCmvc:83vfM+4cCm25hspRmIAWvH

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WizWorm.exe
    "C:\Users\Admin\AppData\Local\Temp\WizWorm.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2076 -s 628
      2⤵
        PID:2628
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2484
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2520

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2076-0-0x0000000000C90000-0x0000000001AE4000-memory.dmp

      Filesize

      14.3MB

    • memory/2076-1-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

    • memory/2076-2-0x000000001BBB0000-0x000000001BC30000-memory.dmp

      Filesize

      512KB

    • memory/2076-3-0x000000001C2A0000-0x000000001D492000-memory.dmp

      Filesize

      17.9MB

    • memory/2076-5-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

      Filesize

      9.9MB

    • memory/2484-4-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

    • memory/2520-6-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

    • memory/2520-7-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB