Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2025, 01:12

General

  • Target

    dfe348365330a95637b9c3cb46019314fee1b363333ed91bbf1d0149b4eea908.exe

  • Size

    195KB

  • MD5

    7e00ba5041aac26048324241b452ad71

  • SHA1

    d6afbf2d3fb24697d57c2e13f4f2550d441a7295

  • SHA256

    dfe348365330a95637b9c3cb46019314fee1b363333ed91bbf1d0149b4eea908

  • SHA512

    ca8c784db34ac2607e30debdad42dab50e8cf1469d1104d5e7bbd33eac6337d2394d711d2921c327d3990ebb5bd56ae3d15249b71cbb16be0461079cc169342f

  • SSDEEP

    6144:8MA/CIqaM6LGR7ltGqRqjEcYgTkTanTzVM3qFYi7:E/lqkTmqFr7

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dfe348365330a95637b9c3cb46019314fee1b363333ed91bbf1d0149b4eea908.exe
    "C:\Users\Admin\AppData\Local\Temp\dfe348365330a95637b9c3cb46019314fee1b363333ed91bbf1d0149b4eea908.exe"
    1⤵
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /release
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4616
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • System Location Discovery: System Language Discovery
        • Gathers network information
        PID:4640
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAZABmAGUAMwA0ADgAMwA2ADUAMwAzADAAYQA5ADUANgAzADcAYgA5AGMAMwBjAGIANAA2ADAAMQA5ADMAMQA0AGYAZQBlADEAYgAzADYAMwAzADMAMwBlAGQAOQAxAGIAYgBmADEAZAAwADEANAA5AGIANABlAGUAYQA5ADAAOAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABkAGYAZQAzADQAOAAzADYANQAzADMAMABhADkANQA2ADMANwBiADkAYwAzAGMAYgA0ADYAMAAxADkAMwAxADQAZgBlAGUAMQBiADMANgAzADMAMwAzAGUAZAA5ADEAYgBiAGYAMQBkADAAMQA0ADkAYgA0AGUAZQBhADkAMAA4AC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABmAG8AbABkAGUAcgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABmAG8AbABkAGUAcgAuAGUAeABlAA==
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 1160
      2⤵
      • Program crash
      PID:4844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3028-0-0x00000000741AE000-0x00000000741AF000-memory.dmp

    Filesize

    4KB

  • memory/3028-1-0x0000000000BE0000-0x0000000000C14000-memory.dmp

    Filesize

    208KB

  • memory/3028-2-0x00000000741A0000-0x000000007488E000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-3-0x0000000006380000-0x0000000006492000-memory.dmp

    Filesize

    1.1MB

  • memory/3028-7-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-4-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-5-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-9-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-11-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-13-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-17-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-21-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-19-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-15-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-23-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-27-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-29-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-49-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-61-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-67-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-65-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-63-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-59-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-57-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-1326-0x00000000741A0000-0x000000007488E000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-55-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-53-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-51-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-47-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-45-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-1327-0x0000000005260000-0x00000000052CC000-memory.dmp

    Filesize

    432KB

  • memory/3028-1328-0x0000000005D60000-0x0000000005DCA000-memory.dmp

    Filesize

    424KB

  • memory/3028-43-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-1329-0x0000000005420000-0x000000000546C000-memory.dmp

    Filesize

    304KB

  • memory/3028-41-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-39-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-37-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-35-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-33-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-31-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-25-0x0000000006380000-0x000000000648C000-memory.dmp

    Filesize

    1.0MB

  • memory/3028-1330-0x00000000741AE000-0x00000000741AF000-memory.dmp

    Filesize

    4KB

  • memory/3028-1331-0x00000000741A0000-0x000000007488E000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-1332-0x00000000741A0000-0x000000007488E000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-1335-0x0000000005480000-0x00000000054D4000-memory.dmp

    Filesize

    336KB

  • memory/3028-1338-0x00000000741A0000-0x000000007488E000-memory.dmp

    Filesize

    6.9MB