Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 07:16

General

  • Target

    00d99925a4af814e5efd09c4a0aede74b50670f85a7a9fe21c65a3210f7055f8.exe

  • Size

    315KB

  • MD5

    54dc9eab8fc06c235c6e42c007a55150

  • SHA1

    f903089de33e5dfa77394b1d6cabfc3fd1641e3b

  • SHA256

    00d99925a4af814e5efd09c4a0aede74b50670f85a7a9fe21c65a3210f7055f8

  • SHA512

    38f57886d87ae391523f6883f71b7c84a273da1a751d5f10ad381c96967e970f1bb9469cb8e4cc1052d0d6df4f99f78c4fdbaaa53676a43dd5208d9823ca2ccd

  • SSDEEP

    6144:sr4bUzkuvcBYC47l2xRBoF15DyKItd1MmQXwjcP2lOo:sr9kuveY3sg1thmdjcuEo

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00d99925a4af814e5efd09c4a0aede74b50670f85a7a9fe21c65a3210f7055f8.exe
    "C:\Users\Admin\AppData\Local\Temp\00d99925a4af814e5efd09c4a0aede74b50670f85a7a9fe21c65a3210f7055f8.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1720

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu326313F3.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{9ADD2FF5-3A82-4930-ABDB-72A0413E0D03}\Custom.dll

    Filesize

    91KB

    MD5

    14d03f73377c34394451d39fa8364c2c

    SHA1

    4312e7abcb79d9d1b4106829fc8290a3df92450a

    SHA256

    77cf95ad8bca51aa6c93805bbeace6eeb40b1b1582c4ddddda7d738359ab523f

    SHA512

    faad5e2d39bd94b36e5a58202e8d7c12ede73c9597d4077d38bc30ce15b32ba4e36769b1bec35bceba2500532ff97dd9da2d8e834042fd723d3d162f9bc2a46a

  • \Users\Admin\AppData\Local\Temp\{9ADD2FF5-3A82-4930-ABDB-72A0413E0D03}\_Setup.dll

    Filesize

    173KB

    MD5

    1d34ad5425b6fe5db18daaa6f4675959

    SHA1

    c6b0b7fd764938c7776df196902950cef5531ed2

    SHA256

    3303e0cbc8374f5a5c5fc6d4869889b354becf625306e9a6e286af507c7e3877

    SHA512

    dd7a8d468769e1ec64781abe861cc44cb78bee628b94fdb4ecf38c31976d13e6d1b848ef16107770c7175dc2618ea5f421af087e5ba30caa83aa006f836f7f39

  • memory/1720-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

    Filesize

    8KB