Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/12/2024, 15:54

General

  • Target

    708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe

  • Size

    928KB

  • MD5

    80b51e872031a2befeb9a0a13e6fc480

  • SHA1

    caebbab5349f57d92182ce56ef4bf71ea60226a7

  • SHA256

    708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089

  • SHA512

    12e9db89be76788d238f8a7f3114534b50b953b9ef619f84b0a124fba77f5e7d4aa00ae8f6ac3fdb16ecd1398950d6bdadfa43e9ec59b6d59667df5ac3d60879

  • SSDEEP

    12288:QieE+Q3mJyrf3iKXlrsfPO/l3Zn+aFpNUe2PPaEEaCh:QieE+5UrfvVg+Rd+afNH2PxEZh

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
    "C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\neHneiobyhcrJJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A88.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2660
    • C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
      "C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe"
      2⤵
        PID:1064
      • C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
        "C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe"
        2⤵
          PID:2212
        • C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
          "C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe"
          2⤵
            PID:2700
          • C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
            "C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe"
            2⤵
              PID:2348
            • C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
              "C:\Users\Admin\AppData\Local\Temp\708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe"
              2⤵
                PID:2224

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp4A88.tmp

              Filesize

              1KB

              MD5

              f5827e870b3f747c58c46ca03ce03bb6

              SHA1

              dcad1b0e42fbbcb7531468ab1c4fc573a89f1982

              SHA256

              59387576b760ac0000e94342e04c62b6ece25f92b2cc143cbce8336210232c7e

              SHA512

              85b377c29937e20d31c1fa0d7e19274cf305fc60f143cb61a1f6c6474b40ccc890556c76f34c83eccfb26fbb9490679b5d4a524b62ce4a1e8fdcd0e183fb4265

            • memory/2128-0-0x000000007449E000-0x000000007449F000-memory.dmp

              Filesize

              4KB

            • memory/2128-1-0x0000000000370000-0x000000000045E000-memory.dmp

              Filesize

              952KB

            • memory/2128-2-0x0000000074490000-0x0000000074B7E000-memory.dmp

              Filesize

              6.9MB

            • memory/2128-3-0x0000000000490000-0x000000000049A000-memory.dmp

              Filesize

              40KB

            • memory/2128-4-0x000000007449E000-0x000000007449F000-memory.dmp

              Filesize

              4KB

            • memory/2128-5-0x0000000074490000-0x0000000074B7E000-memory.dmp

              Filesize

              6.9MB

            • memory/2128-6-0x0000000004E60000-0x0000000004ED2000-memory.dmp

              Filesize

              456KB

            • memory/2128-12-0x0000000074490000-0x0000000074B7E000-memory.dmp

              Filesize

              6.9MB