Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2025, 01:14

General

  • Target

    168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe

  • Size

    1.4MB

  • MD5

    c6489cef651f7a6f4d9334e8c5624c21

  • SHA1

    3f1f9fc649071b90b720a636263db06688d8c335

  • SHA256

    168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f

  • SHA512

    d59ee398cc765103e5c536da4ee1342583960d002d01fe7cd453813abeb4133ae5445fe75a3870f11e972c38c485fdc8cbf0b7a43d33abd423f5765a23de1bab

  • SSDEEP

    24576:v4oq2YnZDCgAHGrwKCY+B9TwP5pxnjRcwhbk2Sxv1RIAhjLoamMiX4lNmZg0YxeY:v/q2YnIdHOC198xvjRRFk2SXjLoyEkmL

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe
    "C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YhhZyXjyqvcDwX.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2704
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YhhZyXjyqvcDwX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA3AF.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2816
    • C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe
      "C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe"
      2⤵
        PID:2560
      • C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe
        "C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe"
        2⤵
          PID:3012
        • C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe
          "C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe"
          2⤵
            PID:2620
          • C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe
            "C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe"
            2⤵
              PID:2076
            • C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe
              "C:\Users\Admin\AppData\Local\Temp\168f80964118bee160ec1c0543f456f1873dca4271e9a2e0d597c651f09a3a6f.exe"
              2⤵
                PID:2712

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpA3AF.tmp

              Filesize

              1KB

              MD5

              aa4d6865a81a7bd8756d361120ae511b

              SHA1

              aa690882b68aeb1901427da54fb5da37d01a33c5

              SHA256

              ffebf4e8c41fd858235b91bcbff78b5ecfa9ddaedd651c6776838e0a3b87dde1

              SHA512

              66f176ea17a9de7d1e0e3ef287e01edc94d58d61fb09565f19528a75f667f46f47d98345deb810c6f356316ab9bbe0f1acb0aa4566c54ac91140db71aca936e5

            • memory/2196-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

              Filesize

              4KB

            • memory/2196-1-0x00000000003A0000-0x000000000050A000-memory.dmp

              Filesize

              1.4MB

            • memory/2196-2-0x00000000747C0000-0x0000000074EAE000-memory.dmp

              Filesize

              6.9MB

            • memory/2196-3-0x0000000000380000-0x0000000000388000-memory.dmp

              Filesize

              32KB

            • memory/2196-4-0x00000000747CE000-0x00000000747CF000-memory.dmp

              Filesize

              4KB

            • memory/2196-5-0x00000000747C0000-0x0000000074EAE000-memory.dmp

              Filesize

              6.9MB

            • memory/2196-6-0x0000000007F60000-0x0000000007FF0000-memory.dmp

              Filesize

              576KB

            • memory/2196-14-0x0000000004D40000-0x0000000004D80000-memory.dmp

              Filesize

              256KB

            • memory/2196-15-0x00000000747C0000-0x0000000074EAE000-memory.dmp

              Filesize

              6.9MB