Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 22:43 UTC

General

  • Target

    S0FTWARE.exe

  • Size

    16KB

  • MD5

    dd59946b381b4c6beda869dab8ce213d

  • SHA1

    0b041a58794c41bcdbd6b9b8ce7f91fc1e9ac0da

  • SHA256

    ec099fec62895533d07c5d83cfaf9913f304b9aa79b12246f8aa77ce7e7cdb33

  • SHA512

    d162ec2a0c039d85beef9af53ab6c7e95dfb6fd87bfdce83f9a0eb62c2e768a569e77fe7116ef99d6ce7d4373de0df874069adc97d6a711d35cbeddc26b3af59

  • SSDEEP

    384:hsvw41oaVEMeH7OdCfUXqwag/SzbvQTyLlsSPT36cQ0m52:U1/V0H7OdCfUXqwageb1l/76cQbY

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\S0FTWARE.exe
    "C:\Users\Admin\AppData\Local\Temp\S0FTWARE.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\yLnAZucfO', 'C:\Users', 'C:\ProgramData'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2688

Network

  • flag-us
    DNS
    github.com
    S0FTWARE.exe
    Remote address:
    8.8.8.8:53
    Request
    github.com
    IN A
    Response
    github.com
    IN A
    20.26.156.215
  • 20.26.156.215:443
    github.com
    tls
    S0FTWARE.exe
    344 B
    179 B
    5
    4
  • 20.26.156.215:443
    github.com
    tls
    S0FTWARE.exe
    344 B
    179 B
    5
    4
  • 20.26.156.215:443
    github.com
    tls
    S0FTWARE.exe
    344 B
    179 B
    5
    4
  • 8.8.8.8:53
    github.com
    dns
    S0FTWARE.exe
    56 B
    72 B
    1
    1

    DNS Request

    github.com

    DNS Response

    20.26.156.215

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1880-0-0x000000007443E000-0x000000007443F000-memory.dmp

    Filesize

    4KB

  • memory/1880-1-0x0000000000D00000-0x0000000000D0A000-memory.dmp

    Filesize

    40KB

  • memory/1880-5-0x000000007443E000-0x000000007443F000-memory.dmp

    Filesize

    4KB

  • memory/1880-10-0x00000000009E0000-0x0000000000A20000-memory.dmp

    Filesize

    256KB

  • memory/1880-11-0x00000000009E0000-0x0000000000A20000-memory.dmp

    Filesize

    256KB

  • memory/2688-4-0x0000000070C01000-0x0000000070C02000-memory.dmp

    Filesize

    4KB

  • memory/2688-6-0x0000000070C00000-0x00000000711AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2688-7-0x0000000070C00000-0x00000000711AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2688-8-0x0000000070C00000-0x00000000711AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2688-9-0x0000000070C00000-0x00000000711AB000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.