Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/09/2024, 13:32

General

  • Target

    purchase order.exe

  • Size

    441KB

  • MD5

    b0783a18de531b50debfe5252bc25558

  • SHA1

    bc564e0ceb0e8f99602247bcc559a583f77db8ce

  • SHA256

    018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f

  • SHA512

    927ff7d89d9820745ab5208793444ade73da993b4c482f31297e093cb9d3cee96a8ae0808c1a4813612d61b1eba4e7d40bc7d9c037f4e337f5dccc4228c25e46

  • SSDEEP

    1536:TzOp02gL1jszmCCCCCpCCCCCTdvCCCCCCCCCCC3CCCCCCCCfFIeCCCCCCCCCCCCv:TzSY+zCdsP6GBxhDCovrU/s

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\purchase order.exe
    "C:\Users\Admin\AppData\Local\Temp\purchase order.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 1044
      2⤵
      • Program crash
      PID:5924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2936-0-0x00000000740BE000-0x00000000740BF000-memory.dmp

    Filesize

    4KB

  • memory/2936-1-0x00000000001F0000-0x0000000000262000-memory.dmp

    Filesize

    456KB

  • memory/2936-2-0x00000000740B0000-0x000000007479E000-memory.dmp

    Filesize

    6.9MB

  • memory/2936-3-0x0000000005970000-0x0000000005A56000-memory.dmp

    Filesize

    920KB

  • memory/2936-13-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-35-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-67-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-65-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-63-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-1079-0x0000000004240000-0x000000000428C000-memory.dmp

    Filesize

    304KB

  • memory/2936-1080-0x00000000740B0000-0x000000007479E000-memory.dmp

    Filesize

    6.9MB

  • memory/2936-1078-0x0000000004CE0000-0x0000000004D42000-memory.dmp

    Filesize

    392KB

  • memory/2936-61-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-59-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-57-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-55-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-53-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-51-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-49-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-47-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-45-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-43-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-41-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-39-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-37-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-33-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-31-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-29-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-27-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-25-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-23-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-21-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-19-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-17-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-15-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-11-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-9-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-7-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-5-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-4-0x0000000005970000-0x0000000005A51000-memory.dmp

    Filesize

    900KB

  • memory/2936-1081-0x00000000740BE000-0x00000000740BF000-memory.dmp

    Filesize

    4KB

  • memory/2936-1082-0x00000000740B0000-0x000000007479E000-memory.dmp

    Filesize

    6.9MB

  • memory/2936-1083-0x0000000005210000-0x0000000005264000-memory.dmp

    Filesize

    336KB