Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2025, 08:32

General

  • Target

    87d1e92e5fd151e6d1fe577ac1a29a209ef249cf4072590c884cda381cef3238.exe

  • Size

    15KB

  • MD5

    42883419315d3cfefe00e016f7b90ec3

  • SHA1

    3f5907a938d5fec88e2255f991a8bb51319277e7

  • SHA256

    87d1e92e5fd151e6d1fe577ac1a29a209ef249cf4072590c884cda381cef3238

  • SHA512

    2d1d8defd6302e1efca80cbca5cdc92ec0b8b574324adf87ecd36e8ae2fbbcb5db0c2b69b59c082cca917e5bd3deaf0f2d2b1ffd9a1a48df9626ad50ba2e5537

  • SSDEEP

    384:B23iPe9ydCzrtx2M9XyXhCqYCln6ve55VXQ:BzgyM9eWve559Q

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87d1e92e5fd151e6d1fe577ac1a29a209ef249cf4072590c884cda381cef3238.exe
    "C:\Users\Admin\AppData\Local\Temp\87d1e92e5fd151e6d1fe577ac1a29a209ef249cf4072590c884cda381cef3238.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\dTgerLxmO'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:496
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    e0b638c03816f8046cf1aec68891faba

    SHA1

    d19b920635e5d150aa4efe8bba4c1f337fdd7862

    SHA256

    7f8b40fc1bd127d2b3cc3fb555ee3763d189883a168bac9826fcedba7aeac0ce

    SHA512

    cd73fce44c5c56d124439de267d5166355486e1143d82763cd12da7956e9c85ca19357536809f59e07deb30be079d4dc909747df009c882b1485abd6f9645fc1

  • memory/496-4-0x00000000711D1000-0x00000000711D2000-memory.dmp

    Filesize

    4KB

  • memory/496-6-0x00000000711D0000-0x000000007177B000-memory.dmp

    Filesize

    5.7MB

  • memory/496-5-0x00000000711D0000-0x000000007177B000-memory.dmp

    Filesize

    5.7MB

  • memory/496-7-0x00000000711D0000-0x000000007177B000-memory.dmp

    Filesize

    5.7MB

  • memory/496-8-0x00000000711D0000-0x000000007177B000-memory.dmp

    Filesize

    5.7MB

  • memory/496-9-0x00000000711D0000-0x000000007177B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

    Filesize

    4KB

  • memory/2516-1-0x0000000000840000-0x000000000084A000-memory.dmp

    Filesize

    40KB

  • memory/2516-15-0x00000000749FE000-0x00000000749FF000-memory.dmp

    Filesize

    4KB

  • memory/2516-16-0x00000000047D0000-0x0000000004810000-memory.dmp

    Filesize

    256KB