Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2025, 14:55

General

  • Target

    Autoruns/Autoruns64.exe

  • Size

    1.9MB

  • MD5

    6ae8e963b33ee52df761412b451b2962

  • SHA1

    f7ab1987848a91af2c77a72583211dcadeed420a

  • SHA256

    f59056339de56820e57c961d6ddd9032bd78af9f2333797944f4ee57b77ee2ca

  • SHA512

    472f07bb37966d056d9efb97e4b686951987ca358a9f213fa6db5ec50cf4a32084cb18c863c8c1add20a2619154cf9f4705541e27c196142917eb9491b54846a

  • SSDEEP

    24576:qU8EqexVDmS0d1ARkxDRlzmYj0tYC/5JReKq1QMcXEkb9fzTXJe:qHEqexVDmSOxxDI5JRhMIFT4

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Autoruns\Autoruns64.exe
    "C:\Users\Admin\AppData\Local\Temp\Autoruns\Autoruns64.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2340

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_F70553637B9F26717122C4DAFA3ADB11

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    71KB

    MD5

    83142242e97b8953c386f988aa694e4a

    SHA1

    833ed12fc15b356136dcdd27c61a50f59c5c7d50

    SHA256

    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

    SHA512

    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

  • C:\Users\Admin\AppData\Local\Temp\CabC91B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarCAA8.tmp

    Filesize

    183KB

    MD5

    109cab5505f5e065b63d01361467a83b

    SHA1

    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

    SHA256

    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

    SHA512

    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

  • memory/2340-147-0x0000000003DD0000-0x0000000003DDB000-memory.dmp

    Filesize

    44KB

  • memory/2340-149-0x0000000003E00000-0x0000000003E15000-memory.dmp

    Filesize

    84KB

  • memory/2340-16-0x0000000003DD0000-0x0000000003E27000-memory.dmp

    Filesize

    348KB

  • memory/2340-13-0x0000000003DD0000-0x0000000003E0E000-memory.dmp

    Filesize

    248KB

  • memory/2340-14-0x0000000003DD0000-0x0000000003E0E000-memory.dmp

    Filesize

    248KB

  • memory/2340-1-0x00000000037F0000-0x0000000003847000-memory.dmp

    Filesize

    348KB

  • memory/2340-54-0x0000000000160000-0x0000000000161000-memory.dmp

    Filesize

    4KB

  • memory/2340-55-0x00000000037F0000-0x0000000003847000-memory.dmp

    Filesize

    348KB

  • memory/2340-150-0x0000000003DD0000-0x0000000003DE7000-memory.dmp

    Filesize

    92KB

  • memory/2340-74-0x0000000003DD0000-0x0000000003E0E000-memory.dmp

    Filesize

    248KB

  • memory/2340-73-0x0000000003E00000-0x0000000003E0A000-memory.dmp

    Filesize

    40KB

  • memory/2340-72-0x0000000003E00000-0x0000000003E0A000-memory.dmp

    Filesize

    40KB

  • memory/2340-76-0x00000000047E0000-0x000000000485B000-memory.dmp

    Filesize

    492KB

  • memory/2340-78-0x0000000003DD0000-0x0000000003E27000-memory.dmp

    Filesize

    348KB

  • memory/2340-77-0x00000000047E0000-0x000000000485B000-memory.dmp

    Filesize

    492KB

  • memory/2340-79-0x0000000003DD0000-0x0000000003E27000-memory.dmp

    Filesize

    348KB

  • memory/2340-80-0x0000000003F50000-0x0000000003FA6000-memory.dmp

    Filesize

    344KB

  • memory/2340-81-0x0000000003F50000-0x0000000003FA6000-memory.dmp

    Filesize

    344KB

  • memory/2340-82-0x0000000003E00000-0x0000000003E2F000-memory.dmp

    Filesize

    188KB

  • memory/2340-83-0x0000000003E00000-0x0000000003E2F000-memory.dmp

    Filesize

    188KB

  • memory/2340-84-0x00000000042D0000-0x0000000004359000-memory.dmp

    Filesize

    548KB

  • memory/2340-85-0x00000000042D0000-0x0000000004359000-memory.dmp

    Filesize

    548KB

  • memory/2340-2-0x00000000037F0000-0x0000000003847000-memory.dmp

    Filesize

    348KB

  • memory/2340-97-0x0000000003DD0000-0x0000000003DE2000-memory.dmp

    Filesize

    72KB

  • memory/2340-96-0x0000000003E00000-0x0000000003E0A000-memory.dmp

    Filesize

    40KB

  • memory/2340-98-0x00000000047E0000-0x000000000485B000-memory.dmp

    Filesize

    492KB

  • memory/2340-100-0x0000000003DD0000-0x0000000003DD7000-memory.dmp

    Filesize

    28KB

  • memory/2340-99-0x0000000003DD0000-0x0000000003DD7000-memory.dmp

    Filesize

    28KB

  • memory/2340-102-0x0000000003F50000-0x0000000003FA6000-memory.dmp

    Filesize

    344KB

  • memory/2340-104-0x0000000003DD0000-0x0000000003DD7000-memory.dmp

    Filesize

    28KB

  • memory/2340-103-0x0000000003DD0000-0x0000000003DD7000-memory.dmp

    Filesize

    28KB

  • memory/2340-101-0x0000000003F50000-0x0000000003FA6000-memory.dmp

    Filesize

    344KB

  • memory/2340-0-0x0000000000160000-0x0000000000161000-memory.dmp

    Filesize

    4KB

  • memory/2340-105-0x0000000003E00000-0x0000000003E2F000-memory.dmp

    Filesize

    188KB

  • memory/2340-107-0x0000000003DD0000-0x0000000003DE7000-memory.dmp

    Filesize

    92KB

  • memory/2340-110-0x0000000003DD0000-0x0000000003DE5000-memory.dmp

    Filesize

    84KB

  • memory/2340-109-0x0000000003DD0000-0x0000000003DE5000-memory.dmp

    Filesize

    84KB

  • memory/2340-108-0x00000000042D0000-0x0000000004359000-memory.dmp

    Filesize

    548KB

  • memory/2340-140-0x0000000003DD0000-0x0000000003DEE000-memory.dmp

    Filesize

    120KB

  • memory/2340-139-0x0000000003DD0000-0x0000000003DEE000-memory.dmp

    Filesize

    120KB

  • memory/2340-138-0x0000000003DD0000-0x0000000003DE2000-memory.dmp

    Filesize

    72KB

  • memory/2340-143-0x0000000003E00000-0x0000000003E47000-memory.dmp

    Filesize

    284KB

  • memory/2340-142-0x0000000003E00000-0x0000000003E47000-memory.dmp

    Filesize

    284KB

  • memory/2340-141-0x0000000003DD0000-0x0000000003DD7000-memory.dmp

    Filesize

    28KB

  • memory/2340-145-0x0000000003DD0000-0x0000000003DDB000-memory.dmp

    Filesize

    44KB

  • memory/2340-144-0x0000000003DD0000-0x0000000003DD7000-memory.dmp

    Filesize

    28KB

  • memory/2340-106-0x0000000003DD0000-0x0000000003DE7000-memory.dmp

    Filesize

    92KB

  • memory/2340-15-0x0000000003DD0000-0x0000000003E27000-memory.dmp

    Filesize

    348KB

  • memory/2340-75-0x0000000003DD0000-0x0000000003E0E000-memory.dmp

    Filesize

    248KB

  • memory/2340-146-0x0000000003DD0000-0x0000000003DD7000-memory.dmp

    Filesize

    28KB

  • memory/2340-148-0x0000000003E00000-0x0000000003E15000-memory.dmp

    Filesize

    84KB

  • memory/2340-153-0x0000000003DD0000-0x0000000003DE5000-memory.dmp

    Filesize

    84KB

  • memory/2340-152-0x0000000003E00000-0x0000000003E19000-memory.dmp

    Filesize

    100KB

  • memory/2340-151-0x0000000003DD0000-0x0000000003DE5000-memory.dmp

    Filesize

    84KB

  • memory/2340-154-0x0000000003E00000-0x0000000003E19000-memory.dmp

    Filesize

    100KB

  • memory/2340-157-0x0000000003E00000-0x0000000003E1B000-memory.dmp

    Filesize

    108KB

  • memory/2340-156-0x0000000003DD0000-0x0000000003DEE000-memory.dmp

    Filesize

    120KB

  • memory/2340-155-0x0000000003DD0000-0x0000000003DEE000-memory.dmp

    Filesize

    120KB

  • memory/2340-159-0x0000000003E00000-0x0000000003E0B000-memory.dmp

    Filesize

    44KB

  • memory/2340-158-0x0000000003E00000-0x0000000003E47000-memory.dmp

    Filesize

    284KB

  • memory/2340-164-0x0000000003E00000-0x0000000003E15000-memory.dmp

    Filesize

    84KB

  • memory/2340-165-0x0000000003F50000-0x0000000003FCB000-memory.dmp

    Filesize

    492KB

  • memory/2340-163-0x0000000003E00000-0x0000000003E15000-memory.dmp

    Filesize

    84KB

  • memory/2340-160-0x0000000003DD0000-0x0000000003DDB000-memory.dmp

    Filesize

    44KB

  • memory/2340-162-0x0000000003E10000-0x0000000003E19000-memory.dmp

    Filesize

    36KB

  • memory/2340-161-0x0000000003E00000-0x0000000003E09000-memory.dmp

    Filesize

    36KB

  • memory/2340-166-0x0000000003E00000-0x0000000003E19000-memory.dmp

    Filesize

    100KB

  • memory/2340-167-0x0000000003E00000-0x0000000003E19000-memory.dmp

    Filesize

    100KB

  • memory/2340-168-0x0000000003E00000-0x0000000003E48000-memory.dmp

    Filesize

    288KB

  • memory/2340-169-0x0000000003E00000-0x0000000003E48000-memory.dmp

    Filesize

    288KB

  • memory/2340-173-0x0000000003E00000-0x0000000003E07000-memory.dmp

    Filesize

    28KB

  • memory/2340-172-0x0000000003E00000-0x0000000003E07000-memory.dmp

    Filesize

    28KB

  • memory/2340-171-0x0000000003E00000-0x0000000003E1B000-memory.dmp

    Filesize

    108KB

  • memory/2340-170-0x0000000003E00000-0x0000000003E1B000-memory.dmp

    Filesize

    108KB

  • memory/2340-177-0x0000000003E00000-0x0000000003E11000-memory.dmp

    Filesize

    68KB

  • memory/2340-176-0x0000000003E00000-0x0000000003E0B000-memory.dmp

    Filesize

    44KB

  • memory/2340-175-0x0000000003E00000-0x0000000003E11000-memory.dmp

    Filesize

    68KB

  • memory/2340-174-0x0000000003E00000-0x0000000003E0B000-memory.dmp

    Filesize

    44KB

  • memory/2340-179-0x0000000003E00000-0x0000000003E1E000-memory.dmp

    Filesize

    120KB

  • memory/2340-180-0x0000000003E00000-0x0000000003E1E000-memory.dmp

    Filesize

    120KB

  • memory/2340-178-0x0000000003E00000-0x0000000003E09000-memory.dmp

    Filesize

    36KB

  • memory/2340-183-0x0000000003E00000-0x0000000003E0A000-memory.dmp

    Filesize

    40KB

  • memory/2340-182-0x0000000003E00000-0x0000000003E0A000-memory.dmp

    Filesize

    40KB

  • memory/2340-181-0x0000000003F50000-0x0000000003FCB000-memory.dmp

    Filesize

    492KB

  • memory/2340-184-0x0000000003E00000-0x0000000003E48000-memory.dmp

    Filesize

    288KB

  • memory/2340-185-0x0000000003E00000-0x0000000003E08000-memory.dmp

    Filesize

    32KB

  • memory/2340-186-0x0000000003E00000-0x0000000003E48000-memory.dmp

    Filesize

    288KB

  • memory/2340-188-0x0000000003F50000-0x0000000003F9C000-memory.dmp

    Filesize

    304KB

  • memory/2340-187-0x0000000003E00000-0x0000000003E07000-memory.dmp

    Filesize

    28KB

  • memory/2340-189-0x0000000003F50000-0x0000000003F9C000-memory.dmp

    Filesize

    304KB

  • memory/2340-192-0x0000000003F50000-0x0000000003F60000-memory.dmp

    Filesize

    64KB

  • memory/2340-191-0x0000000003F50000-0x0000000003F60000-memory.dmp

    Filesize

    64KB

  • memory/2340-190-0x0000000003E00000-0x0000000003E11000-memory.dmp

    Filesize

    68KB

  • memory/2340-194-0x0000000003E20000-0x0000000003E24000-memory.dmp

    Filesize

    16KB

  • memory/2340-193-0x0000000003E00000-0x0000000003E1E000-memory.dmp

    Filesize

    120KB

  • memory/2340-195-0x0000000003E00000-0x0000000003E0A000-memory.dmp

    Filesize

    40KB