Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

3

d616cbddb7...0N.exe

windows7-x64

5

d616cbddb7...0N.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 23:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d616cbddb72e70e1c9b1df04b130ba40N.exe

  • Size

    45KB

  • MD5

    d616cbddb72e70e1c9b1df04b130ba40

  • SHA1

    0de6512680c8bcf0309aaf5cf875460b348f8162

  • SHA256

    177de3453b36feb92a7a3ca8f957af382d1ac32161b6cd5ca8e152e5f2bb2a1a

  • SHA512

    549d7ca708040beb2f3fe63637f6569031c6b66db740fadb015357aaeda116191cc37e5c0d801e87de0919c7d7fb157310d2b63fc8a413a9544663371bcc0e56

  • SSDEEP

    768:IPUgM68+2fNyAPmokoPzdj3cH3UPXGYCAjC4R8emLvRYWszo+uh22ofRsl8Lc9qQ:3LzNDPrkgzdLckP5CZs81mWdwRsl3

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\d616cbddb72e70e1c9b1df04b130ba40N.exe
        "C:\Users\Admin\AppData\Local\Temp\d616cbddb72e70e1c9b1df04b130ba40N.exe"
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3044

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1204-2-0x0000000002620000-0x0000000002628000-memory.dmp

      Filesize

      32KB

      Download

    • memory/3044-0-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

      Download

    • memory/3044-3-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

      Download