Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

f8fcc607a0...41.exe

windows7-x64

8

f8fcc607a0...41.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/06/2024, 18:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f8fcc607a0e63d040f026594919f3e699389bdaae59d9a62aa9180f531ebba41.exe

  • Size

    736KB

  • MD5

    00a3df9592388ecc06661a751e701814

  • SHA1

    b3e59bcec03a9662b6f2c194de497df4168a20b5

  • SHA256

    f8fcc607a0e63d040f026594919f3e699389bdaae59d9a62aa9180f531ebba41

  • SHA512

    9a8349929e588ca256b44f7167e989d9b84b3e18e53203ac0135bac6d8db81a5affcf9a68adcb82815bbc99be1ac9790b10a4b95ca9f8aa3e57eede00adc603b

  • SSDEEP

    12288:GPOHeO7HKsOjt+iRdY1YwcH2aOTRdpl9PLkmwlzDwoBvgDTSxHOkgCx+Oe9lGlU:TJjKsOj3R9wcWaONdH9YTdwgvSTiuO+p

Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8fcc607a0e63d040f026594919f3e699389bdaae59d9a62aa9180f531ebba41.exe
    "C:\Users\Admin\AppData\Local\Temp\f8fcc607a0e63d040f026594919f3e699389bdaae59d9a62aa9180f531ebba41.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f8fcc607a0e63d040f026594919f3e699389bdaae59d9a62aa9180f531ebba41.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2536
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zKSqGBWbc.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2720
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zKSqGBWbc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp60A6.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2448
    • C:\Users\Admin\AppData\Local\Temp\f8fcc607a0e63d040f026594919f3e699389bdaae59d9a62aa9180f531ebba41.exe
      "C:\Users\Admin\AppData\Local\Temp\f8fcc607a0e63d040f026594919f3e699389bdaae59d9a62aa9180f531ebba41.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 36
        3⤵
        • Program crash
        PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp60A6.tmp
    Filesize

    1KB

    MD5

    91d21940697540e5e53e3d7afdeb16d8

    SHA1

    4066a7a39741225a8457aee40bed8a29662af472

    SHA256

    cf07d0d3c6df6218670467e0dbe1a10fa0b0f2601f7baa63f0a63fc7146c44e3

    SHA512

    1588ec89068008c25f70af739731744acd391b50e3acdb629ddf3033ff82cbd15f7a919f8a16f6ecf43edea23ebe64bde159ef479c7b342cd68f857946e9e137

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    4eb1b81348797059bb578572ac643df5

    SHA1

    b0f183bf7a96b4d8552d8fc6590c27c2d6f4288b

    SHA256

    00c7976dd15ecd20d582b32c68bd65e401be3194a169d826c0cfc7876f22ac65

    SHA512

    9f266d95f23c9c186c36185a98d5d76132aae2e1d79273d6a0c9c7105ea7f10a384f6503b55ea4693a4f440a62c0469b7808c454e7c2a2f2c4a727e3c7bfdfa6

    Download Submit

  • memory/2532-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2532-23-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/2532-20-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/2532-18-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/2964-3-0x0000000000480000-0x0000000000498000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2964-4-0x0000000000550000-0x0000000000560000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2964-5-0x0000000005E70000-0x0000000005EFA000-memory.dmp

    Filesize

    552KB

    Download

  • memory/2964-2-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2964-1-0x0000000000ED0000-0x0000000000F8C000-memory.dmp

    Filesize

    752KB

    Download

  • memory/2964-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2964-24-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB

    Download