Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 01:21

General

  • Target

    6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe

  • Size

    3.4MB

  • MD5

    1e39051f272c9dd66693fcc1ae6aee05

  • SHA1

    f60504bcff01280c4526b021bd6c111497122adb

  • SHA256

    6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca

  • SHA512

    f86346021d53ac75dd953d7a5556b81b8b79ebafbd0ef21902a27da903f87e8e140402e5cf97564c35c1fe187699649be949de32f0fcf0de3a8af942e96debbd

  • SSDEEP

    98304:17+LSnP94zHiut+bGAbqILvyx0L332Wmcg/Q:aSyz7AblvyWz14

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe
    "C:\Users\Admin\AppData\Local\Temp\6689317ecb790f63a8fb1c5e6ca0e17bb113a8f0b086c2572c6dac267e634cca.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\System32\dllhost.exe
      "C:\Windows\System32\dllhost.exe"
      2⤵
        PID:2760

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2112-20-0x000000013F3E0000-0x00000001403ED000-memory.dmp

      Filesize

      16.1MB

    • memory/2112-23-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB

    • memory/2112-4-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB

    • memory/2112-3-0x0000000077BF1000-0x0000000077BF2000-memory.dmp

      Filesize

      4KB

    • memory/2112-2-0x000000013F3E0000-0x00000001403ED000-memory.dmp

      Filesize

      16.1MB

    • memory/2112-21-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

      Filesize

      3.8MB

    • memory/2112-0-0x000000013F3E0000-0x00000001403ED000-memory.dmp

      Filesize

      16.1MB

    • memory/2112-1-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

      Filesize

      3.8MB

    • memory/2760-22-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB

    • memory/2760-19-0x0000000000050000-0x0000000000056000-memory.dmp

      Filesize

      24KB

    • memory/2760-24-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB

    • memory/2760-25-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB

    • memory/2760-26-0x0000000000270000-0x000000000027A000-memory.dmp

      Filesize

      40KB

    • memory/2760-28-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB

    • memory/2760-27-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB

    • memory/2760-29-0x0000000077BA0000-0x0000000077D49000-memory.dmp

      Filesize

      1.7MB