Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/11/2024, 21:21

General

  • Target

    TTDesktop18.exe

  • Size

    13KB

  • MD5

    22bded153b8c1ec4b1d1b45e0467f7c6

  • SHA1

    1c8825442a455da9ffa0fd56e0e2848dfa58bf2c

  • SHA256

    f07f39ca504a15d670eecad52c272ed5cdc4025fede61cd910d7da2a55d1d052

  • SHA512

    f6022cbf7120e1771e7ba992bcd59ba5f8f68507d91c10c997a3186766547ea0632347facfdec667c3bde261748eb93ee8df35c71600fd7c459539f629b408bb

  • SSDEEP

    192:0qgaiJUFTQcHVPtAXjJ9vT2O3yP8B50LOZdBcmCEJXVWwTnkVOvQu:57zFEcH769vT2OCkB50LknnVTnkVUQ

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TTDesktop18.exe
    "C:\Users\Admin\AppData\Local\Temp\TTDesktop18.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\zJbNeNwUcE'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\zJbNeNwUcE
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3020
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    65de7613b3560647a22896183dd208ce

    SHA1

    d729f7df31c0eb8fdaeb37161528b5f583948618

    SHA256

    8b9b4a3b94cfeaceb08580a214e2e636ac94386b277a65bb49cc5f1ba4a23231

    SHA512

    0240b3d51fcb48fd5dbdf96f153d34e5af2c5e6543c8eaa82dc846d6d11bd9784790083cfcf34d9405ea59f886d34f3c7eb950c65867030eed1dfb732778859c

  • memory/2668-0-0x000000007433E000-0x000000007433F000-memory.dmp

    Filesize

    4KB

  • memory/2668-1-0x0000000000E20000-0x0000000000E2A000-memory.dmp

    Filesize

    40KB

  • memory/2668-35-0x000000007433E000-0x000000007433F000-memory.dmp

    Filesize

    4KB

  • memory/2668-36-0x00000000047C0000-0x0000000004800000-memory.dmp

    Filesize

    256KB

  • memory/2816-4-0x0000000070F21000-0x0000000070F22000-memory.dmp

    Filesize

    4KB

  • memory/2816-5-0x0000000070F20000-0x00000000714CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2816-7-0x0000000070F20000-0x00000000714CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2816-6-0x0000000070F20000-0x00000000714CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2816-8-0x0000000070F20000-0x00000000714CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2816-14-0x0000000070F20000-0x00000000714CB000-memory.dmp

    Filesize

    5.7MB