Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/11/2024, 05:54
General
-
Target
b73851a896ad6ab227ab328c05f7d87110997a87c86e455427dba87addfdc6eb.exe
-
Size
48KB
-
MD5
0e4f25c408fcd0dcc7e4d3f05db57e7e
-
SHA1
373eeb5ba8be5a003f2b6648fdbf3852acde6838
-
SHA256
b73851a896ad6ab227ab328c05f7d87110997a87c86e455427dba87addfdc6eb
-
SHA512
42d2bf3c5329045840c32c1fc621fecf6c1ff1975fdf6f6042f788c3ec77fee738f0beefc61248d661a9d7ecc4a5b0319097a9d0fc9ffd5fd82347b6be7d3de9
-
SSDEEP
768:qVtN0XHONQwQeGTwK0NHXsH6bJCYhx8HV0kvcUwSuUCw3+MK:qVlN8HTwKqWAxcpvcqu74+J
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b73851a896ad6ab227ab328c05f7d87110997a87c86e455427dba87addfdc6eb.exe"C:\Users\Admin\AppData\Local\Temp\b73851a896ad6ab227ab328c05f7d87110997a87c86e455427dba87addfdc6eb.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD536c1ffb97a8a0c53a37652369b1b4687
SHA1cd8dd85eb3372f51027d979dcf51bde3c665fedf
SHA2564bc43e954be1d6969ef2093cded65737be9536e71c5024301c2f5eb1230014aa
SHA512d5742eb933356535b75194dbefe3f3ada5819a4fcc9c0e03551af3a29ee64c04921754d0e1ca4b18bbe31831827c44d0f361ca67301c35f7e02ab7a0b5f04279
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB