Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 18:09

General

  • Target

    archive/Setup.exe

  • Size

    792.5MB

  • MD5

    882c754fb952c8abb850dc3c11c7fde2

  • SHA1

    668d6cd355a11ca4af98275b89be3ed27af1a918

  • SHA256

    9c6d924afa3b84241a00762d243b156a2af26374154de67a89cda3e4ef37a2c8

  • SHA512

    7f9fea9b477f3eba99db92cd076320b29db1e603797c4ade3f5bba1543cb7711f92a19b73c214ed92443218a805a4ed3ea4bf4d46eed1c43486801481b186b9b

  • SSDEEP

    98304:94zumTUVxOTJeP4tQt26kDyy14zv6rsps+eZPvHlZ7K:94M8JBta26kGyM3ni/lZ7

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\archive\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\archive\Setup.exe"
    1⤵
    • Modifies firewall policy service
    • Drops file in System32 directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    PID:2508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    165b834be31bdb67af7461d12a170d65

    SHA1

    6fea257a4275edb7da6e363b3443f5b732f41b93

    SHA256

    1d332fd5541c37cf20af074f39b07c603fab51cb08f5654d273e8fe475b00e43

    SHA512

    e78e10336a879bc09fa170d63294d716bf99fa3de9315a15c58abe208849f716353b77c0bac6e8392eb7e34d7ae8ef28b776e9a0a750ba8bd7bec2c464b48fc7

  • C:\Users\Admin\AppData\Local\Temp\Cab22EE.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar237D.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2508-6-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

    Filesize

    8KB

  • memory/2508-34-0x000007FEFCED0000-0x000007FEFCED2000-memory.dmp

    Filesize

    8KB

  • memory/2508-18-0x0000000076EC0000-0x0000000076EC2000-memory.dmp

    Filesize

    8KB

  • memory/2508-16-0x0000000076EC0000-0x0000000076EC2000-memory.dmp

    Filesize

    8KB

  • memory/2508-15-0x0000000076EB0000-0x0000000076EB2000-memory.dmp

    Filesize

    8KB

  • memory/2508-13-0x0000000076EB0000-0x0000000076EB2000-memory.dmp

    Filesize

    8KB

  • memory/2508-11-0x0000000076EB0000-0x0000000076EB2000-memory.dmp

    Filesize

    8KB

  • memory/2508-10-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

    Filesize

    8KB

  • memory/2508-8-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

    Filesize

    8KB

  • memory/2508-0-0x000000013F7D6000-0x000000013FA4A000-memory.dmp

    Filesize

    2.5MB

  • memory/2508-36-0x000007FEFCED0000-0x000007FEFCED2000-memory.dmp

    Filesize

    8KB

  • memory/2508-20-0x0000000076EC0000-0x0000000076EC2000-memory.dmp

    Filesize

    8KB

  • memory/2508-31-0x000007FEFCEC0000-0x000007FEFCEC2000-memory.dmp

    Filesize

    8KB

  • memory/2508-29-0x000007FEFCEC0000-0x000007FEFCEC2000-memory.dmp

    Filesize

    8KB

  • memory/2508-26-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

    Filesize

    8KB

  • memory/2508-24-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

    Filesize

    8KB

  • memory/2508-22-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

    Filesize

    8KB

  • memory/2508-21-0x000000013F670000-0x000000013FEAE000-memory.dmp

    Filesize

    8.2MB

  • memory/2508-5-0x0000000076E90000-0x0000000076E92000-memory.dmp

    Filesize

    8KB

  • memory/2508-1-0x0000000076E90000-0x0000000076E92000-memory.dmp

    Filesize

    8KB

  • memory/2508-3-0x0000000076E90000-0x0000000076E92000-memory.dmp

    Filesize

    8KB

  • memory/2508-119-0x000000013F7D6000-0x000000013FA4A000-memory.dmp

    Filesize

    2.5MB

  • memory/2508-120-0x000000013F670000-0x000000013FEAE000-memory.dmp

    Filesize

    8.2MB