Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/09/2024, 01:18
General
-
Target
52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79.exe
-
Size
3.2MB
-
MD5
56969d3e42eb60bc95c97d51377f0de8
-
SHA1
6d9844be2bbcc86f9c07d8d40c774ce642502c4f
-
SHA256
52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79
-
SHA512
ad81e190b09b211a63ea9917934909576ee43c8f97f1b98020c0add770d57214a7e4ae11bc9601f42fced0124072a148d68dddd175995e1a8126de03d59112a0
-
SSDEEP
98304:DHK+r2k6cc9zrObZKEM8O8PluQhfgN5/7FBR:DHKRk8CsEEOfyd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79.exe"C:\Users\Admin\AppData\Local\Temp\52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GIQ8zR8vsm.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\taskhost.exe"C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\taskhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD556969d3e42eb60bc95c97d51377f0de8
SHA16d9844be2bbcc86f9c07d8d40c774ce642502c4f
SHA25652f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79
SHA512ad81e190b09b211a63ea9917934909576ee43c8f97f1b98020c0add770d57214a7e4ae11bc9601f42fced0124072a148d68dddd175995e1a8126de03d59112a0
-
Filesize
203B
MD518f7e891941596ef11239ee4cda7feae
SHA1ce3bd9ec68c8d66d7bbf124f5b6feb24cb8e4dfb
SHA256bfb9393a4ebfdc3b74dde0a094a21e371400e97c23bee398054ff6529db199af
SHA51286c0cba8f4393035c301d613e51290df644d699e900a40543d4af610000411a25c52087849997ed09ae3ea08400ae858726d5be624cdd049dca243a5fe408a6e
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
152KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
360KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
312KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
9.9MB