Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    21s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    30/07/2024, 18:20

General

  • Target

    Payment Prove for Invoice No.126789.exe

  • Size

    218KB

  • MD5

    19c2e374a191ee18466c11cefeddbe75

  • SHA1

    6a6b1d342f67705a05c3eda5f8121b76e4a72e04

  • SHA256

    fd4dbce199d52440961eec1b4557d51014ff2ed2278466b84925eb5f7b38c13d

  • SHA512

    3a94415990bacc4cb8d9c68a1e65e0bfb999fd944e161a22d5709545919143ffa344f624a212347d76364653ed0e06fe320aaff43bbbba4bbadfdf7f6deb7dc1

  • SSDEEP

    3072:BtvW1h07m6MfaxOhHwlzErARHTvpyJWA3l9MwO078PMznseowDGooqRJYuEK39uj:BtT7PMixWQlvDcJKwZXowbosYPK39u0

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Prove for Invoice No.126789.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Prove for Invoice No.126789.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2876-0-0x000000007495E000-0x000000007495F000-memory.dmp

    Filesize

    4KB

  • memory/2876-1-0x0000000000F90000-0x0000000000FCC000-memory.dmp

    Filesize

    240KB

  • memory/2876-2-0x0000000074950000-0x000000007503E000-memory.dmp

    Filesize

    6.9MB

  • memory/2876-3-0x0000000000250000-0x000000000025A000-memory.dmp

    Filesize

    40KB

  • memory/2876-4-0x0000000074950000-0x000000007503E000-memory.dmp

    Filesize

    6.9MB

  • memory/2876-5-0x0000000074950000-0x000000007503E000-memory.dmp

    Filesize

    6.9MB