Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15/05/2021, 16:53

General

  • Target

    7330a4d4e3b4a85418cabd7b97c84717db6286a1ce417c91bd556c95d91f1ff9.exe

  • Size

    197KB

  • MD5

    4bd934db4189d2e7800589ab9bf859be

  • SHA1

    aee15222baea35959e4d779223dc9872e188663e

  • SHA256

    7330a4d4e3b4a85418cabd7b97c84717db6286a1ce417c91bd556c95d91f1ff9

  • SHA512

    9613016d2f7af573b5b40f3f0af399333f46e350229f0f665c71dc1f2645299f7e97624200464a403a4b56d52836075a6e533b2cd9b77309a5d84353243c6031

Score
10/10

Malware Config

Signatures

  • Vobfus

    A widespread worm which spreads via network drives and removable media.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7330a4d4e3b4a85418cabd7b97c84717db6286a1ce417c91bd556c95d91f1ff9.exe
    "C:\Users\Admin\AppData\Local\Temp\7330a4d4e3b4a85418cabd7b97c84717db6286a1ce417c91bd556c95d91f1ff9.exe"
    1⤵
    • Adds policy Run key to start application
    • Adds Run key to start application
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:3400

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3400-114-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB