Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

PO-09OCT20...df.scr

windows7-x64

8

PO-09OCT20...df.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2025, 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO-09OCT2024-1.pdf.scr

  • Size

    764KB

  • MD5

    1d278e311f71d28a7b468c9e8c42d3e8

  • SHA1

    9deb9da31e00f63d2a607d717c26a3d29e1ded5f

  • SHA256

    2817a9a6fc061c9f8e6e7c341b778b403ceaeb439cb8e40760c908ada5c323cd

  • SHA512

    2c994e0637a9a0ed662f65a8316aee8c8d781f5770090e4bb6e35315dc9f042cb4f712fbe7a809424ad9391299beec23dfccf010d55d063186485af49b3f813f

  • SSDEEP

    12288:vcmEZ3bkiEWVZ25bNMHWQLElf7MIboj2buIVToTX6PUVgIGi7TykR:vEtBEWVE5GHWQLEl+2t0TqUVgK

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr
    "C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr" /S
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2760
    • C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr
      "C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr"
      2⤵
        PID:2828
      • C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr
        "C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr"
        2⤵
          PID:2836
        • C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr
          "C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr"
          2⤵
            PID:2916
          • C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr
            "C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr"
            2⤵
              PID:3036
            • C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr
              "C:\Users\Admin\AppData\Local\Temp\PO-09OCT2024-1.pdf.scr"
              2⤵
                PID:2772

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1956-0-0x000000007456E000-0x000000007456F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1956-1-0x0000000000380000-0x0000000000442000-memory.dmp

              Filesize

              776KB

              Download

            • memory/1956-2-0x0000000074560000-0x0000000074C4E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/1956-3-0x0000000001F40000-0x0000000001F58000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1956-4-0x000000007456E000-0x000000007456F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1956-5-0x0000000074560000-0x0000000074C4E000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/1956-6-0x0000000004FD0000-0x0000000005046000-memory.dmp

              Filesize

              472KB

              Download

            • memory/1956-9-0x0000000074560000-0x0000000074C4E000-memory.dmp

              Filesize

              6.9MB

              Download