Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 15:06

General

  • Target

    29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e.exe

  • Size

    56KB

  • MD5

    6bf9b57f0c5dede417585f341dcc2f40

  • SHA1

    e40bf30d3a2c596df93b5fb197f5956f4eb7851b

  • SHA256

    29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e

  • SHA512

    b9f03328af9e836d9851896c2fe477551626d22f16327030045a27ee1821556711ab32de513d6521e2c5fb6fc87423e1cf14cecc2fe8031faaa28902b0ae5322

  • SSDEEP

    768:uyP0mzpASojkUKp2vQ3Oo4XQX+yFMw1+gWRrlLVYmYZd9zcqZf:fQjf/1QX+gMwk7rrYBbx

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e.exe
    "C:\Users\Admin\AppData\Local\Temp\29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e.exe
      C:\Users\Admin\AppData\Local\Temp\29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:460
      • C:\Windows\SysWOW64\Fixdriver.exe
        "C:\Windows\system32\Fixdriver.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\Fixdriver.exe
          C:\Windows\SysWOW64\Fixdriver.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Fixdriver.exe

    Filesize

    56KB

    MD5

    6bf9b57f0c5dede417585f341dcc2f40

    SHA1

    e40bf30d3a2c596df93b5fb197f5956f4eb7851b

    SHA256

    29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e

    SHA512

    b9f03328af9e836d9851896c2fe477551626d22f16327030045a27ee1821556711ab32de513d6521e2c5fb6fc87423e1cf14cecc2fe8031faaa28902b0ae5322

  • C:\Windows\SysWOW64\Fixdriver.exe

    Filesize

    56KB

    MD5

    6bf9b57f0c5dede417585f341dcc2f40

    SHA1

    e40bf30d3a2c596df93b5fb197f5956f4eb7851b

    SHA256

    29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e

    SHA512

    b9f03328af9e836d9851896c2fe477551626d22f16327030045a27ee1821556711ab32de513d6521e2c5fb6fc87423e1cf14cecc2fe8031faaa28902b0ae5322

  • C:\Windows\SysWOW64\Fixdriver.exe

    Filesize

    56KB

    MD5

    6bf9b57f0c5dede417585f341dcc2f40

    SHA1

    e40bf30d3a2c596df93b5fb197f5956f4eb7851b

    SHA256

    29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e

    SHA512

    b9f03328af9e836d9851896c2fe477551626d22f16327030045a27ee1821556711ab32de513d6521e2c5fb6fc87423e1cf14cecc2fe8031faaa28902b0ae5322

  • \Windows\SysWOW64\Fixdriver.exe

    Filesize

    56KB

    MD5

    6bf9b57f0c5dede417585f341dcc2f40

    SHA1

    e40bf30d3a2c596df93b5fb197f5956f4eb7851b

    SHA256

    29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e

    SHA512

    b9f03328af9e836d9851896c2fe477551626d22f16327030045a27ee1821556711ab32de513d6521e2c5fb6fc87423e1cf14cecc2fe8031faaa28902b0ae5322

  • \Windows\SysWOW64\Fixdriver.exe

    Filesize

    56KB

    MD5

    6bf9b57f0c5dede417585f341dcc2f40

    SHA1

    e40bf30d3a2c596df93b5fb197f5956f4eb7851b

    SHA256

    29dff93774750f7f7491597d1e5ca0390ccf7f98f2b28a1f7e829af74078b50e

    SHA512

    b9f03328af9e836d9851896c2fe477551626d22f16327030045a27ee1821556711ab32de513d6521e2c5fb6fc87423e1cf14cecc2fe8031faaa28902b0ae5322

  • memory/460-57-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-59-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-67-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-66-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

    Filesize

    8KB

  • memory/460-91-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-56-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-60-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-63-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-62-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/460-70-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1104-68-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1520-92-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1672-87-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB