Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 11:56

General

  • Target

    office2019pjb_9435/office2019pjb/OTool/files/Thunder/MiniThunderPlatform.exe

  • Size

    66KB

  • MD5

    ef69dc57c378255b9cb240397e330958

  • SHA1

    c53da31492f7a281546a7531999f9a3b4cf37515

  • SHA256

    d8085eed2d4bac6d78a3f66cde18f64dfd11c6466b58fdbaf3ad24f6cd874640

  • SHA512

    d48f3ee6d02d5c8fd895caad481a7df8e82ff7ef0559db9aef799a863e0857e3df5a207b48565f7ccf9b0a4717577a32a09523b6bf8b2f54a5d0327f10c06f02

  • SSDEEP

    1536:gc5k9Y9Zm5dlTeDnS1EM67R7D2/h8+nouy85uMA:gc2em0TS2BdHeh8eout5uMA

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\MiniThunderPlatform.exe
    "C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\MiniThunderPlatform.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:2020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2020-0-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2020-2-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB