Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/04/2024, 14:27

240423-rsfnfshb26 3

23/04/2024, 14:24

240423-rqq2eaha3t 3

Analysis

  • max time kernel
    117s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/04/2024, 14:24

General

  • Target

    Toolbox OptimizerV1.0.exe

  • Size

    455KB

  • MD5

    0569b38220c2d30697ffbc398308f213

  • SHA1

    d01b93f9b2c6c6f8269e47134ee2a8639cdb29af

  • SHA256

    cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e

  • SHA512

    380ad86a1f83d2f9cd2461f666fc38245c8a0dea1a6bcdf5ad5b161fd72d092826cb5fb33bb278cec09866e9a8dfa95b054fa1d35719e52665e85cfbdfe9374f

  • SSDEEP

    3072:Q7DhdC6kzWypvaQ0FxyNTBf87pzseuW8Rz7m2klts+CDiVsgw7b6:QBlkZvaF4NTBE7LUKwzgw7b6

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7E06.tmp\7E07.tmp\7E08.bat "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\system32\mode.com
        mode con:cols=128 lines=40
        3⤵
          PID:1296

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7E06.tmp\7E07.tmp\7E08.bat

      Filesize

      87KB

      MD5

      3512b263fbfaa854e3dffc248d511dd4

      SHA1

      db752939ffb2659bd32b9c4b91c2173a6a505082

      SHA256

      7dc4222c41085904ae65a81d758911fd0b1ef3f0578368fc5d17c3e0240d2450

      SHA512

      8f54d744bf9e1368352049f3ec9aa5422494c66d7ea1e9893b3d0daecc773810148076dcfe1160b2f36ee93aa5b18ff013992b6e3abd1c8517429ff76b54cba2