Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    17/04/2022, 14:39

General

  • Target

    691474717b13721b4eb72bbc46d541e942b040e53a6dcfbd5523b17ec148051a.exe

  • Size

    6.6MB

  • MD5

    98366e6b49a53c7deb39432a8435f157

  • SHA1

    ea7c48a4b4d86c392d418b0d555d1b523ad808f6

  • SHA256

    691474717b13721b4eb72bbc46d541e942b040e53a6dcfbd5523b17ec148051a

  • SHA512

    a6f60b27647cceb56a410c0dde727f87b32a22b683a74461a464fe1bf1029023f8a1cc43c1a8adf976e7d390390e50c930cf756b59b7524456dc617f359defee

Score
10/10

Malware Config

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Buer Loader 3 IoCs

    Detects Buer loader in memory or disk.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\691474717b13721b4eb72bbc46d541e942b040e53a6dcfbd5523b17ec148051a.exe
    "C:\Users\Admin\AppData\Local\Temp\691474717b13721b4eb72bbc46d541e942b040e53a6dcfbd5523b17ec148051a.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of SetWindowsHookEx
    PID:1280

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1280-54-0x00000000756E1000-0x00000000756E3000-memory.dmp

    Filesize

    8KB

  • memory/1280-55-0x00000000003E0000-0x00000000003EC000-memory.dmp

    Filesize

    48KB

  • memory/1280-59-0x0000000040000000-0x0000000040009000-memory.dmp

    Filesize

    36KB

  • memory/1280-62-0x00000000002D0000-0x00000000002D9000-memory.dmp

    Filesize

    36KB