Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2024, 14:40

General

  • Target

    MalwareBazaar.exe

  • Size

    1.2MB

  • MD5

    5f9a0cb83894c70bc24e0f9254fb8c47

  • SHA1

    4a72402a2de6f13d3bc7aea07efe0fb0942ed740

  • SHA256

    b79a12b0fc47bdaa7e1da3863e004d5e4a9acfcbb251ee60248564ceeb451b8d

  • SHA512

    8f9e3557d4fcc2471d234fc7b1495993706edb24a38f9067239afe05371d170754e121e2ce8eadd1a949ad0d86f639a2f3bf7b386e3633d2e5bf4a6d1e466c03

  • SSDEEP

    24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aNiSSHyA1jXh:hTvC/MTQYxsWR7aNiSSFpX

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
    "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ultraradicalism

    Filesize

    281KB

    MD5

    69d66bc768f1c50e4ea1cf68a0d92602

    SHA1

    b2a549ef3d452d85af705764760903224a5d5522

    SHA256

    539bf6030060fb375c51f71c206921d1511d6c138b7286ce84abfa63aca9c2a4

    SHA512

    ab1df0052568119868b60407d8a5741008c26309871911d06f58d50959d7ac44c7c8064b94c7952807b7b9cf15051840a6898cdcd0bdef628bbc97c38df49373

  • memory/2832-13-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/2832-14-0x0000000000890000-0x0000000000B93000-memory.dmp

    Filesize

    3.0MB

  • memory/2832-15-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/2832-16-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/3044-12-0x00000000001E0000-0x00000000001E4000-memory.dmp

    Filesize

    16KB