Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/01/2025, 22:15

250122-16g8wayrdm 10

22/01/2025, 18:33

250122-w67fjsyrcs 10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 18:33

General

  • Target

    DemonSpoofCall.exe

  • Size

    9.7MB

  • MD5

    1dfe6d227d66658b9ab790ce66160551

  • SHA1

    62087a4f6c0b47635f068262b3d9df15aab746d9

  • SHA256

    c2d4aff226178355b8ef7b9e28e4d2869def12eacdfe91e9ed1135b6cd20deab

  • SHA512

    c10e34658ea727c52f96051fd9fe6d3c1b6f3dbeed9b9ced6bbfd2819db3a8aaeea693f890581190d3d10749e3000f8088c543d8cd006301c0b3032c4457d454

  • SSDEEP

    196608:lrkCDFxgtiWe4/RSgOqTn9nBIzuZrSW+xHGoFlaoDKWzQo1OIg5sa7t:5eiYRNXnDZrSF8oF9uB5B

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DemonSpoofCall.exe
    "C:\Users\Admin\AppData\Local\Temp\DemonSpoofCall.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 1720
      2⤵
      • Program crash
      PID:320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cf9aa085769296c0ee2aeb78ddf0dede

    SHA1

    e6e98be873818689a67762b64eb5aecb716ad064

    SHA256

    06a72c65091cf4d2b8e9e8a2b7959ddb9a6fce71871611f30c6f0b027207dd48

    SHA512

    0373e21e0c094c07caca4b5bb67be3ab02ef4acffeff3fb593af4499812368e672b019a75cb2560a8fa61113e9b4e573138cde7e108b10abfadb012fe3089e46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    57685d05b13a1fd6228af6323154dd42

    SHA1

    8b5526c5f7d21575689a9afc171c499166458e8f

    SHA256

    bab45b6b73de2c60764fbf1f9f968d7241cdedd37bea92a27a8e9aaf07c99765

    SHA512

    e43ff44b9f134627b0dad1b51afa5c771c86ade46bdc51f5bab6b3de3d253ba6ce5e948c98012585fe6437879ab4fa615ff8a2bce93fd4283f6733777242abdc

  • C:\Users\Admin\AppData\Local\Temp\CabAF93.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarB022.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1984-0-0x0000000000DA4000-0x0000000000DA5000-memory.dmp

    Filesize

    4KB