Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 03:23 UTC

General

  • Target

    6425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9.exe

  • Size

    16KB

  • MD5

    acfdf588da4f3d02f8b4e6db8cc9e60d

  • SHA1

    71bc876820b36d478f65cb9f236499d8c98a7fdd

  • SHA256

    6425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9

  • SHA512

    3698487d35e5d12d013c4f986375191e645038fa3199d7950c03370c085533aa6da2710ab2c9b7f200d5625c90b39bb5580fbf0dfced9cad6ebac86e001d83b8

  • SSDEEP

    384:eRc06pZg1jOAJO0lsJeho4ZbP5bvGINB9FlbP4Nk:qX6pZgAiO0Be49RlNB9XbQK

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9.exe
    "C:\Users\Admin\AppData\Local\Temp\6425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1264
      2⤵
      • Program crash
      PID:2680

Network

  • flag-us
    DNS
    www.smithpropertysolutions.com
    6425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9.exe
    Remote address:
    8.8.8.8:53
    Request
    www.smithpropertysolutions.com
    IN A
    Response
    www.smithpropertysolutions.com
    IN A
    74.208.236.140
  • 74.208.236.140:443
    www.smithpropertysolutions.com
    tls
    6425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9.exe
    364 B
    219 B
    5
    5
  • 8.8.8.8:53
    www.smithpropertysolutions.com
    dns
    6425c4148a69abba62149c51dbb1850731a25c4ca8232c3d6304a20c0545d8c9.exe
    76 B
    92 B
    1
    1

    DNS Request

    www.smithpropertysolutions.com

    DNS Response

    74.208.236.140

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3068-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

    Filesize

    4KB

  • memory/3068-1-0x0000000000C30000-0x0000000000C3A000-memory.dmp

    Filesize

    40KB

  • memory/3068-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

    Filesize

    6.9MB

  • memory/3068-3-0x0000000073F10000-0x00000000745FE000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.