Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2025, 18:33

General

  • Target

    PlaylistGeneratorPro.exe

  • Size

    3.2MB

  • MD5

    f9fd3035e88efea757ca653b360ec2fe

  • SHA1

    da1647e0287281ec190fab7805b4f72efef782c6

  • SHA256

    f95705a5f3e2c572db21e58f4b516a6030d95c4b358c20a36b1c15a215e12c80

  • SHA512

    70d4b5c2344ef0143a36cde824d44c1b0ea1f111c1877812765d0a2baa9f7178d0a307256a02de6f877b5c78c203bddbd5a805e6eb14d6c99d18943fc131a22a

  • SSDEEP

    49152:5Gvr1ImETNsn4+0AWSQFxFvV8gd5duBPfl3dkzT6UFTVANx:5GvudPS2xFP5yPfCFqj

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Banload family
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PlaylistGeneratorPro.exe
    "C:\Users\Admin\AppData\Local\Temp\PlaylistGeneratorPro.exe"
    1⤵
    • Checks BIOS information in registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2440-1-0x00000000029D0000-0x0000000002B42000-memory.dmp

    Filesize

    1.4MB

  • memory/2440-8-0x00000000029D0000-0x0000000002B42000-memory.dmp

    Filesize

    1.4MB

  • memory/2440-0-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-13-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-14-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-20-0x0000000003AF0000-0x0000000003B10000-memory.dmp

    Filesize

    128KB

  • memory/2440-18-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-17-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-15-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-19-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-22-0x0000000000400000-0x00000000009D4000-memory.dmp

    Filesize

    5.8MB

  • memory/2440-23-0x00000000029D0000-0x0000000002B42000-memory.dmp

    Filesize

    1.4MB