Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 05:01

General

  • Target

    e4a80a2a613cb9c431f24feb87e2fc7f71703ac18ffdccaf94c34daa78a2df2a.exe

  • Size

    3.0MB

  • MD5

    82eedc336e823c4a61b69b172a24514f

  • SHA1

    1c9ddec914347b4eb917ce37be5727d67fbd9625

  • SHA256

    e4a80a2a613cb9c431f24feb87e2fc7f71703ac18ffdccaf94c34daa78a2df2a

  • SHA512

    54da9da0fc928fa959bd5b5975013bccf5ac9bc952f3f02dc75a3cd1fa0391158c207534c532db5d82363a679fdb0ebdce60be03f505a3bee34bd511f3038b23

  • SSDEEP

    49152:+ZnCRw3438x0TVDKNxOafuUYUc9no2IWkAyf1CQ+v5XxCv6Pxjd:+ARw3UJKHOa/Xffs0S5jd

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 6 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4a80a2a613cb9c431f24feb87e2fc7f71703ac18ffdccaf94c34daa78a2df2a.exe
    "C:\Users\Admin\AppData\Local\Temp\e4a80a2a613cb9c431f24feb87e2fc7f71703ac18ffdccaf94c34daa78a2df2a.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{7D2B03B8-0977-485E-AF89-DFD8A501AEDC}\CCDInstaller.js

    Filesize

    1.2MB

    MD5

    fb970bc9889933229160723a60571dde

    SHA1

    b1b68348b77101b31bea510311c6e85451f833fc

    SHA256

    39e34fc3dfd74d25631ea2fecaca70a5d767b5f3f40f24380237dc06a80252e2

    SHA512

    65c4b44e42c7d94a89be9b18ef7589f16f247f47f459da2e8b59b4ffbbba25cbb07971f8484e9bc25bd8c6f953a291ab9384a154aab9ad1572375b3b30c31886

  • C:\Users\Admin\AppData\Local\Temp\{7D2B03B8-0977-485E-AF89-DFD8A501AEDC}\index.html

    Filesize

    426B

    MD5

    a28ab17b18ff254173dfeef03245efd0

    SHA1

    c6ce20924565644601d4e0dd0fba9dde8dea5c77

    SHA256

    886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

    SHA512

    9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

  • memory/1776-0-0x00000000009B0000-0x0000000001375000-memory.dmp

    Filesize

    9.8MB

  • memory/1776-14-0x00000000005D0000-0x00000000005D1000-memory.dmp

    Filesize

    4KB

  • memory/1776-31-0x0000000004B30000-0x0000000004B50000-memory.dmp

    Filesize

    128KB

  • memory/1776-32-0x0000000004B30000-0x0000000004B50000-memory.dmp

    Filesize

    128KB

  • memory/1776-60-0x00000000009B0000-0x0000000001375000-memory.dmp

    Filesize

    9.8MB

  • memory/1776-62-0x00000000005D0000-0x00000000005D1000-memory.dmp

    Filesize

    4KB

  • memory/1776-63-0x00000000009B0000-0x0000000001375000-memory.dmp

    Filesize

    9.8MB

  • memory/1776-64-0x00000000009B0000-0x0000000001375000-memory.dmp

    Filesize

    9.8MB

  • memory/1776-67-0x00000000009B0000-0x0000000001375000-memory.dmp

    Filesize

    9.8MB

  • memory/1776-73-0x00000000009B0000-0x0000000001375000-memory.dmp

    Filesize

    9.8MB