Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    17/06/2024, 00:38

General

  • Target

    setup.exe

  • Size

    3.1MB

  • MD5

    e2aca2b2deb86d9ea1d6366a64116409

  • SHA1

    61b41909160be6c93c8541a24d3fd38f354ddbea

  • SHA256

    d3b72b8843161aab5e17f1a9b2f0bc14be06a9c905328b48eb39230cfe638f5c

  • SHA512

    11f22c59276b518e3303548e3e8321347052de048844a48a75b840d141f1dd5ba5c4ef105aa35924d380eff8dbdf9454bdf99cba55ff6d70c5d24f6fe96df1ea

  • SSDEEP

    49152:6kVfvS+pDTGuzVnck9inHEywFQXHdG5DSDgWeLB38EwAxaJq1EWgges5y1a2rT9h:6Gf62yuzAH9w8HA5+Dz6tAQsjT9

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Modifies firewall policy service
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:348
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 348 -s 228
      2⤵
        PID:2464

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/348-0-0x000000013FDC5000-0x000000013FF8B000-memory.dmp

      Filesize

      1.8MB

    • memory/348-3-0x00000000779B0000-0x00000000779B2000-memory.dmp

      Filesize

      8KB

    • memory/348-1-0x00000000779B0000-0x00000000779B2000-memory.dmp

      Filesize

      8KB

    • memory/348-5-0x00000000779B0000-0x00000000779B2000-memory.dmp

      Filesize

      8KB

    • memory/348-8-0x00000000779C0000-0x00000000779C2000-memory.dmp

      Filesize

      8KB

    • memory/348-6-0x00000000779C0000-0x00000000779C2000-memory.dmp

      Filesize

      8KB

    • memory/348-10-0x00000000779C0000-0x00000000779C2000-memory.dmp

      Filesize

      8KB

    • memory/348-13-0x00000000779D0000-0x00000000779D2000-memory.dmp

      Filesize

      8KB

    • memory/348-11-0x00000000779D0000-0x00000000779D2000-memory.dmp

      Filesize

      8KB

    • memory/348-15-0x00000000779D0000-0x00000000779D2000-memory.dmp

      Filesize

      8KB

    • memory/348-20-0x00000000779E0000-0x00000000779E2000-memory.dmp

      Filesize

      8KB

    • memory/348-18-0x00000000779E0000-0x00000000779E2000-memory.dmp

      Filesize

      8KB

    • memory/348-16-0x00000000779E0000-0x00000000779E2000-memory.dmp

      Filesize

      8KB

    • memory/348-25-0x000007FEFDC30000-0x000007FEFDC32000-memory.dmp

      Filesize

      8KB

    • memory/348-23-0x000007FEFDC30000-0x000007FEFDC32000-memory.dmp

      Filesize

      8KB

    • memory/348-30-0x000007FEFDC40000-0x000007FEFDC42000-memory.dmp

      Filesize

      8KB

    • memory/348-28-0x000007FEFDC40000-0x000007FEFDC42000-memory.dmp

      Filesize

      8KB

    • memory/348-31-0x000000013FC60000-0x0000000140291000-memory.dmp

      Filesize

      6.2MB

    • memory/348-42-0x000000013FDC5000-0x000000013FF8B000-memory.dmp

      Filesize

      1.8MB