Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 03:08

General

  • Target

    f1062808f8659980062e3cb4a4a5065e5cf4a16b9425daffd92add5b28231740.exe

  • Size

    327KB

  • MD5

    61121ef6b83eec195652b1886e215700

  • SHA1

    9daf7b67559214fba86bf3f2532371d6a818de22

  • SHA256

    f1062808f8659980062e3cb4a4a5065e5cf4a16b9425daffd92add5b28231740

  • SHA512

    e5b1ace20bc10b55d906f87a31153f6643ddbbea974432b7cb1414c9462e034b78ba69baf3488a1826d931a8fa83c956abcb1862b42783b031b0c530bf45fec5

  • SSDEEP

    6144:0r5bUzkuvcBYC47l2xtOMBOk40RUb01O3cj9/cpY7pSWZvgBpTEaCia:0rqkuveY3GOMBw0RYMj9kpcpSsvUT4ia

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1062808f8659980062e3cb4a4a5065e5cf4a16b9425daffd92add5b28231740.exe
    "C:\Users\Admin\AppData\Local\Temp\f1062808f8659980062e3cb4a4a5065e5cf4a16b9425daffd92add5b28231740.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1600

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu58D6E9E2.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{6238826F-001C-40B1-A25A-483EB9DBA099}\Custom.dll

    Filesize

    91KB

    MD5

    734225cb2540b6ea71d2fe1ef8d42e1f

    SHA1

    078786a455720521670d54e1335eb54361cab21f

    SHA256

    13e1bd1730329a3d77c6d3fad3a46c042a786b243a6d567e6abf1b2e716d4dec

    SHA512

    4575274733b2aba223df2ae37cbaf3552f4f821dfb7089126ce16962442d2f10c1f1ea7fd60ff4232972e3d3fd9ce859f4ab2eea275ab59b4bd4426f9e201103

  • \Users\Admin\AppData\Local\Temp\{6238826F-001C-40B1-A25A-483EB9DBA099}\_Setup.dll

    Filesize

    183KB

    MD5

    9e898ffdc682cf853f7df237678a6f3a

    SHA1

    55cacb14771890e8028a8a9ce8ae936dff17944f

    SHA256

    e78f957aceb637683a41b00dd094d4e88f706b94fd7b679b35add56269e4d047

    SHA512

    942746351a7c0f43f633a4732ca54404b4d8e767616ffe724e265359506375f9c3b5c3a84a46b3ec452ae4b5d80a966d3b6b5aa0161c2150db39cb84c588a9d0

  • memory/1600-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

    Filesize

    8KB