Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    46s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 13:29

General

  • Target

    55f9af3202a3c5b101549912a36863b40c7b69aa75d09d0f5d50bed63493a2db.exe

  • Size

    304KB

  • MD5

    834dd6bfc2621c6b9f595c9c0b19aa96

  • SHA1

    0ae6b05da4fc14949200193455002f836fa34a8a

  • SHA256

    55f9af3202a3c5b101549912a36863b40c7b69aa75d09d0f5d50bed63493a2db

  • SHA512

    ea25b83a9675efb76e91621e5a09014dd30994309361d691bcfdfa7aeef3f6186c92d1eab8f0ee5eb8fc30783b33a997feee20ec89d5b58fc6d45915f3d3b918

  • SSDEEP

    6144:icNM1BDtGwp9jscwrtNXZoQSbGqJDIy88YaR5iLFBq5+Z6:iyKjsXtoQSz78/aR5iGW6

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies AppInit DLL entries 2 TTPs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55f9af3202a3c5b101549912a36863b40c7b69aa75d09d0f5d50bed63493a2db.exe
    "C:\Users\Admin\AppData\Local\Temp\55f9af3202a3c5b101549912a36863b40c7b69aa75d09d0f5d50bed63493a2db.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:852
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {EEF67EFF-EEF1-45C6-B426-0AFD5E438F3E} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\PROGRA~3\Mozilla\jjruejn.exe
      C:\PROGRA~3\Mozilla\jjruejn.exe -npivonl
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      PID:560

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\jjruejn.exe

    Filesize

    304KB

    MD5

    3590b6fbb5976991d7e0e04ccc411062

    SHA1

    6f77a71208deb20be2672fc5b14b9c4d9525837b

    SHA256

    9f77188c525ad979adb253a1161dbf159a9ede36d61fc7d16fa0e4858614a419

    SHA512

    fdb65685dc2858a177fb407a89e02152529d4d61e05ca8a82906073340bb6037e30718a80a5bbe18a4136902d77b474af8f5c81d903345b865e52626324b0608

  • C:\PROGRA~3\Mozilla\jjruejn.exe

    Filesize

    304KB

    MD5

    3590b6fbb5976991d7e0e04ccc411062

    SHA1

    6f77a71208deb20be2672fc5b14b9c4d9525837b

    SHA256

    9f77188c525ad979adb253a1161dbf159a9ede36d61fc7d16fa0e4858614a419

    SHA512

    fdb65685dc2858a177fb407a89e02152529d4d61e05ca8a82906073340bb6037e30718a80a5bbe18a4136902d77b474af8f5c81d903345b865e52626324b0608

  • memory/560-62-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/560-63-0x0000000000460000-0x00000000004BC000-memory.dmp

    Filesize

    368KB

  • memory/560-64-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/852-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

    Filesize

    8KB

  • memory/852-55-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/852-56-0x0000000001B80000-0x0000000001BDC000-memory.dmp

    Filesize

    368KB

  • memory/852-57-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB