Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 05:42

General

  • Target

    62b4126eb794e768faab3a789fcd00d024485a8e5aae8e582a8af12ec6d8b5f1.exe

  • Size

    451KB

  • MD5

    4718d21d65c4217c467d33323ba09ff0

  • SHA1

    4128a6af3e8bf26b040103e318699c4324209806

  • SHA256

    62b4126eb794e768faab3a789fcd00d024485a8e5aae8e582a8af12ec6d8b5f1

  • SHA512

    c0612dfbb6589ecba6e1339073796bdf495790ecdef9c58b12c547758761b122e223987c4e79524f5b4db05a989b389455f46bc9781447ac2bfd9b288bc59ccb

  • SSDEEP

    12288:5/kviXzdteey0HHgXwr38Eh+Mb86O7rFTHKB3ta:7dtzjHYwX1bg7oA

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62b4126eb794e768faab3a789fcd00d024485a8e5aae8e582a8af12ec6d8b5f1.exe
    "C:\Users\Admin\AppData\Local\Temp\62b4126eb794e768faab3a789fcd00d024485a8e5aae8e582a8af12ec6d8b5f1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Users\Admin\AppData\Local\Temp\djgmejcgdblwff.exe
      "C:\Users\Admin\AppData\Local\Temp\\djgmejcgdblwff.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\djgmejcgdblwff.exe

    Filesize

    11KB

    MD5

    702cafa129a698906160b1605c354729

    SHA1

    3166b8b4b9b3123473f449859953587b80649192

    SHA256

    c16d843b5abe3a481f938abc11d7c79dc99d522ce89ac4089ad2f49f934cd16a

    SHA512

    b66dcab23eeadc6466174b78fe2840ebc8f26baba5ed24a457dc0614b227315c16c1542ef8b3dd2917e786a6558f1e0f48f0ed2bb4af5a95c8f94127969d6656

  • C:\Users\Admin\AppData\Local\Temp\parent.txt

    Filesize

    451KB

    MD5

    4718d21d65c4217c467d33323ba09ff0

    SHA1

    4128a6af3e8bf26b040103e318699c4324209806

    SHA256

    62b4126eb794e768faab3a789fcd00d024485a8e5aae8e582a8af12ec6d8b5f1

    SHA512

    c0612dfbb6589ecba6e1339073796bdf495790ecdef9c58b12c547758761b122e223987c4e79524f5b4db05a989b389455f46bc9781447ac2bfd9b288bc59ccb

  • \Users\Admin\AppData\Local\Temp\djgmejcgdblwff.exe

    Filesize

    11KB

    MD5

    702cafa129a698906160b1605c354729

    SHA1

    3166b8b4b9b3123473f449859953587b80649192

    SHA256

    c16d843b5abe3a481f938abc11d7c79dc99d522ce89ac4089ad2f49f934cd16a

    SHA512

    b66dcab23eeadc6466174b78fe2840ebc8f26baba5ed24a457dc0614b227315c16c1542ef8b3dd2917e786a6558f1e0f48f0ed2bb4af5a95c8f94127969d6656

  • \Users\Admin\AppData\Local\Temp\djgmejcgdblwff.exe

    Filesize

    11KB

    MD5

    702cafa129a698906160b1605c354729

    SHA1

    3166b8b4b9b3123473f449859953587b80649192

    SHA256

    c16d843b5abe3a481f938abc11d7c79dc99d522ce89ac4089ad2f49f934cd16a

    SHA512

    b66dcab23eeadc6466174b78fe2840ebc8f26baba5ed24a457dc0614b227315c16c1542ef8b3dd2917e786a6558f1e0f48f0ed2bb4af5a95c8f94127969d6656

  • memory/1940-58-0x000007FEF47E0000-0x000007FEF5203000-memory.dmp

    Filesize

    10.1MB

  • memory/1940-59-0x000007FEF3740000-0x000007FEF47D6000-memory.dmp

    Filesize

    16.6MB

  • memory/1940-61-0x000007FEFC3B1000-0x000007FEFC3B3000-memory.dmp

    Filesize

    8KB