Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    07/08/2024, 01:36

General

  • Target

    65576d11600ac393a2b85adf316bb23c44d0a1b6e7dd5b1aa76d702d8a9b6a8b.exe

  • Size

    934KB

  • MD5

    89f2a2b6a40d32641a95888e3aabcd03

  • SHA1

    f65a0ff0e403adc9b097d29fc5d60d8c6818f0ea

  • SHA256

    65576d11600ac393a2b85adf316bb23c44d0a1b6e7dd5b1aa76d702d8a9b6a8b

  • SHA512

    37628c276c0fb811be6841ecce62030033e99579e162f6fa69456c17596f75c2c4568a133acd5befcc73274bbb49fc1b1a3fc112b1b1f27a3a525a23a79b93ce

  • SSDEEP

    12288:NzlU13Q1mgtgYLf13Q+9PJ/l8jBiIjfElEbm9/Gi:s36/FqpElEbm9/

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65576d11600ac393a2b85adf316bb23c44d0a1b6e7dd5b1aa76d702d8a9b6a8b.exe
    "C:\Users\Admin\AppData\Local\Temp\65576d11600ac393a2b85adf316bb23c44d0a1b6e7dd5b1aa76d702d8a9b6a8b.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2672-0-0x000007FEF68D3000-0x000007FEF68D4000-memory.dmp

    Filesize

    4KB

  • memory/2672-1-0x00000000001A0000-0x000000000028C000-memory.dmp

    Filesize

    944KB

  • memory/2672-2-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-3-0x000000001D020000-0x000000001D13C000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-4-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-5-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-7-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-11-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-23-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-27-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-37-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-45-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-55-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-53-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-51-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-49-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-47-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-43-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-41-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-39-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-57-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-35-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-33-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-31-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-29-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-25-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-21-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-19-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-17-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-15-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-13-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-9-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-59-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-65-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-63-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-68-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-61-0x000000001D020000-0x000000001D137000-memory.dmp

    Filesize

    1.1MB

  • memory/2672-1040-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-1041-0x0000000000820000-0x0000000000826000-memory.dmp

    Filesize

    24KB

  • memory/2672-1043-0x0000000000970000-0x00000000009BC000-memory.dmp

    Filesize

    304KB

  • memory/2672-1042-0x000000001B6D0000-0x000000001B76E000-memory.dmp

    Filesize

    632KB

  • memory/2672-1044-0x000007FEF68D3000-0x000007FEF68D4000-memory.dmp

    Filesize

    4KB

  • memory/2672-1045-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-1046-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-1048-0x000000001AEB0000-0x000000001AF04000-memory.dmp

    Filesize

    336KB

  • memory/2672-1049-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/2672-1052-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/4832-1053-0x0000000000060000-0x00000000000AB000-memory.dmp

    Filesize

    300KB

  • memory/4832-1054-0x000007FEF68D3000-0x000007FEF68D4000-memory.dmp

    Filesize

    4KB

  • memory/4832-1055-0x0000000000C50000-0x0000000000C96000-memory.dmp

    Filesize

    280KB

  • memory/4832-1056-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/4832-1057-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/4832-1058-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/4832-1059-0x000007FEF68D3000-0x000007FEF68D4000-memory.dmp

    Filesize

    4KB

  • memory/4832-1060-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB

  • memory/4832-1061-0x000007FEF68D0000-0x000007FEF72BC000-memory.dmp

    Filesize

    9.9MB