Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2024, 05:58

General

  • Target

    Ref#20203216.exe

  • Size

    150KB

  • MD5

    9f9df5620e05da5bbf797b8531da35ab

  • SHA1

    22be3755c61f577fb39e4d71df0f8d9bfb90aa87

  • SHA256

    e97247599a336032a86ea5cb42b3b9c971567977e245b689d87c3f2ef3d200e4

  • SHA512

    365554a00606263906af881542ff87999c32d30389798219deb9cb384874a9700eba56ee883b1dc5238890a6a5ea15f8c3861182b267fb0a6b196bcbdf39e480

  • SSDEEP

    1536:aj9JxITkjSu9L8xIWCPAHWoTwuckbZrSV6ICB3pQpYvNX81zJfqK6XiFZKj:aj+TTup8omWiwLcCxSZQpe5WzJfV62M

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ref#20203216.exe
    "C:\Users\Admin\AppData\Local\Temp\Ref#20203216.exe"
    1⤵
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 1676
      2⤵
      • Program crash
      PID:6388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2620-0-0x000000007469E000-0x000000007469F000-memory.dmp

    Filesize

    4KB

  • memory/2620-1-0x0000000001140000-0x000000000116A000-memory.dmp

    Filesize

    168KB

  • memory/2620-2-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2620-3-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2620-4-0x0000000006170000-0x000000000626A000-memory.dmp

    Filesize

    1000KB

  • memory/2620-16-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-14-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-12-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-10-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-8-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-6-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-5-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-1186-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2620-1183-0x00000000059C0000-0x0000000005A14000-memory.dmp

    Filesize

    336KB

  • memory/2620-1182-0x0000000005970000-0x00000000059BC000-memory.dmp

    Filesize

    304KB

  • memory/2620-1181-0x00000000046D0000-0x000000000473A000-memory.dmp

    Filesize

    424KB

  • memory/2620-68-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-66-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-64-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-54-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-52-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-50-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-48-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-46-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-44-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-42-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-40-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-36-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-34-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-32-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-30-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-28-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-26-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-62-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-60-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-58-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-56-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-39-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-24-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-22-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-20-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-18-0x0000000006170000-0x0000000006264000-memory.dmp

    Filesize

    976KB

  • memory/2620-1187-0x000000007469E000-0x000000007469F000-memory.dmp

    Filesize

    4KB