Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 02:08

General

  • Target

    8d7268dc2e1d5dfd9979ffd4c4c9b1c387381cf4a927c87b903a1d040e870b5d.exe

  • Size

    539KB

  • MD5

    035ca9ee48415e67cdaefcb2e1e85676

  • SHA1

    3f1be34578354621ce03a0a16fc86587f5b34b40

  • SHA256

    8d7268dc2e1d5dfd9979ffd4c4c9b1c387381cf4a927c87b903a1d040e870b5d

  • SHA512

    8af8a3f4eecf154531e10f760ca1979d51b89788ffa878c5fabd6fdc58855b4408b47a5f364679462d77a3d6e7c15d890101993d0f2b04538020e50279489d7a

  • SSDEEP

    12288:NtKe6Zv23YdRjJFw9TMbZ678m9i8Syy0B0IHjEZ:d6Zv2ojJFwFcwr0tZ

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d7268dc2e1d5dfd9979ffd4c4c9b1c387381cf4a927c87b903a1d040e870b5d.exe
    "C:\Users\Admin\AppData\Local\Temp\8d7268dc2e1d5dfd9979ffd4c4c9b1c387381cf4a927c87b903a1d040e870b5d.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:1608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe

    Filesize

    544KB

    MD5

    8d1f15605709b53f9beb9abe22a1e929

    SHA1

    07faf0eab86c4ac492558fcef1c813a24f2d41e2

    SHA256

    bce880312f4b9a8a17f8476b6f41bdf0f9b31fa9544e105d5ebc56b7300e66f8

    SHA512

    4b52c1de70a085b473b7e57ca6ce113206bc3d76186dfa88a59d59a3a7edf9c86c269909d5f4ce8d2bea522786aa8d21844970402827e4c708366ab601b24b9e

  • memory/1608-58-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1608-59-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2032-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2032-56-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB