Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:15

General

  • Target

    be1643898cf51a24e38e4044d24ae1f5.exe

  • Size

    1.8MB

  • MD5

    be1643898cf51a24e38e4044d24ae1f5

  • SHA1

    5b53f0997c5be65bd91489a11ee51517c0b1925b

  • SHA256

    6c2eeaf52182de0791d8e04149fef6ba87cbeed544ec5337199506888b747d94

  • SHA512

    c0451369d080d8a0ddfdea774f4c0a0c261ca9bebb5511355211a6557ff6d04e79fde17bffaec8ad1bdbfcf33aca9ca5e6604caa0be8ff6e97d2a4421550a44b

  • SSDEEP

    49152:ifccx7xHddXQ5xobHeDyrso2FuE4QAE6v7O1dg:AdpQ5SzetjIQF

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be1643898cf51a24e38e4044d24ae1f5.exe
    "C:\Users\Admin\AppData\Local\Temp\be1643898cf51a24e38e4044d24ae1f5.exe"
    1⤵
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYgBlADEANgA0ADMAOAA5ADgAYwBmADUAMQBhADIANABlADMAOABlADQAMAA0ADQAZAAyADQAYQBlADEAZgA1AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGIAZQAxADYANAAzADgAOQA4AGMAZgA1ADEAYQAyADQAZQAzADgAZQA0ADAANAA0AGQAMgA0AGEAZQAxAGYANQAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AUwBDAFAASABCAG8AbwB0AFUAdABpAGwALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AUwBDAFAASABCAG8AbwB0AFUAdABpAGwALgBlAHgAZQA=
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 700
      2⤵
      • Program crash
      PID:4876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2128-11-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-33-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-2-0x0000000001210000-0x000000000131C000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-3-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2128-4-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-15-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-37-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-45-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-43-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-41-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-39-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-35-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-9-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-31-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-29-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-27-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-25-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-23-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-21-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-19-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-17-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-13-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-1-0x0000000001350000-0x000000000151C000-memory.dmp

    Filesize

    1.8MB

  • memory/2128-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

    Filesize

    4KB

  • memory/2128-57-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-5-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-65-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-67-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-63-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-61-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-59-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-7-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-55-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-53-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-51-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-49-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-47-0x0000000001210000-0x0000000001316000-memory.dmp

    Filesize

    1.0MB

  • memory/2128-1326-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2128-1327-0x0000000004920000-0x0000000004986000-memory.dmp

    Filesize

    408KB

  • memory/2128-1328-0x0000000004990000-0x00000000049F2000-memory.dmp

    Filesize

    392KB

  • memory/2128-1329-0x0000000004A00000-0x0000000004A4C000-memory.dmp

    Filesize

    304KB

  • memory/2128-1330-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

    Filesize

    4KB

  • memory/2128-1331-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2128-1332-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2128-1339-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2128-1336-0x00000000051D0000-0x0000000005224000-memory.dmp

    Filesize

    336KB

  • memory/4736-1335-0x0000000002580000-0x00000000025C0000-memory.dmp

    Filesize

    256KB