Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    389s
  • max time network
    428s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2022, 14:14

General

  • Target

    Master3DRPG_beta(v.3.5.4)/Master3DRPG_v3.5.4.exe

  • Size

    700.1MB

  • MD5

    c3bc2bcdce7d92a82c6b5a8679aa5914

  • SHA1

    8a7ace913d835e66981939b76dc1903699333e86

  • SHA256

    82d8bb8a09bbd84a603c5c1d6d543ededece7492d51a80f6d55f5187bb547b15

  • SHA512

    d22b8ca7587a58009c652da6d41c8a7111151aa53e1d94da206fb18427aabc94a18df4494d0a08fa6dddd103d41ab585713b09a5b0548446351986ebfa0f9f00

  • SSDEEP

    1536:LZvXriaCwQJ2DN2K2mW1kVl943EAfmTwHSHtQcJR6QA:hWr2DN2x1kVsiwyNQcJR6QA

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe
      "C:\Users\Admin\AppData\Local\Temp\Master3DRPG_beta(v.3.5.4)\Master3DRPG_v3.5.4.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 372
        3⤵
        • Program crash
        PID:1612

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1644-63-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-68-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-58-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1644-55-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1644-59-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1644-62-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1644-78-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-56-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1644-65-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-67-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1644-70-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-73-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-72-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-75-0x0000000075C61000-0x0000000075C63000-memory.dmp

    Filesize

    8KB

  • memory/1644-76-0x0000000006980000-0x0000000006C41000-memory.dmp

    Filesize

    2.8MB

  • memory/1644-57-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/2032-54-0x0000000000120000-0x000000000013C000-memory.dmp

    Filesize

    112KB