Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

2024-06-16...il.exe

windows7-x64

6

2024-06-16...il.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 09:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-16_ef2a6e3cfb93de64881f7fd186d8ca6d_magniber_metamorfo_revil.exe

  • Size

    62.8MB

  • MD5

    ef2a6e3cfb93de64881f7fd186d8ca6d

  • SHA1

    29c80647a89583ffb16971cbf6fbf1b1eec5511b

  • SHA256

    e0ee894cfd2261833558adfdec60137cdc62db037cb1104845b5ee2c8a00a0b3

  • SHA512

    bf94f92c2e651b071440b3be70449610bb42b2e954125fd91daf3049235ab9b4fb39599e38707062cdc03bb39bd63c0aefc1631aef2bf955914d1a5bad1053a8

  • SSDEEP

    1572864:wYSh80NRJYm88Ak7qu1FU2175J+XVFzdHt2qH8kuvcEbQHz:X480d8/TKU2klldH5HBwbQT

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 1 IoCs
  • Loads dropped DLL 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-16_ef2a6e3cfb93de64881f7fd186d8ca6d_magniber_metamorfo_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-16_ef2a6e3cfb93de64881f7fd186d8ca6d_magniber_metamorfo_revil.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Loads dropped DLL
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\curlnet.dll
    Filesize

    1.9MB

    MD5

    e15587d7d769364e990ff64c179ac455

    SHA1

    b0e10d8cd2d317932021c8da97245ba1f322c79c

    SHA256

    ef82853f2cd9c473267a051672f16c0ed78ddb26489c41dd9206460e325ec5af

    SHA512

    f8666baaf5099af60dfdaf6a187d18b040d0de03d1949f8c72c510dab964d940b3aba01c9efd209fba7bcca5758140040799025e09d56c3e22a815975c4ee260

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{5F2A6E11-93CF-47ce-85C5-E2FBB20605FE}.tmp\7z.dll
    Filesize

    1.2MB

    MD5

    81799e4e4882bd26a9ae77f19ab735a4

    SHA1

    217804e437fdb651a2716a59049223fd5d8ed438

    SHA256

    df92ddec48aece5dd961cd9594ef8c6063206a768662afa735d2a977dd3f9dcc

    SHA512

    3678a35ac135040c4e9c441a2ca21c03b5bfbafc08d1109a629246c7b42d6eb467a000a8002f40f251c0b6e5f4af3ba6c684af55b9f9533eadcd6602e7c5c4e4

    Download Submit

  • memory/2856-28-0x0000000000A80000-0x0000000000A81000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2856-115-0x0000000000A80000-0x0000000000A81000-memory.dmp

    Filesize

    4KB

    Download