Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    183s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 00:52

General

  • Target

    1ebdae46a825b4df85070969bae0268618c6ac75d26157f388c9d2aebb5a363d.exe

  • Size

    508KB

  • MD5

    91911213300cd15005ab39ec689c6fd0

  • SHA1

    26e775fbb13ec0cbad9799ab59ca4326e619f521

  • SHA256

    1ebdae46a825b4df85070969bae0268618c6ac75d26157f388c9d2aebb5a363d

  • SHA512

    5bc66ba3c5c2c942965631d084ef4e334db510add2e660c6c32924345fb42f8a3dad592e6472030be4c6cebfc1a93449072e0a82607f65e41b9fa781b9ef1d28

  • SSDEEP

    12288:NtKe6Zv23YdRjJDn0NxLK6q/H7rFR2AwdEUcYqD:d6Zv2ojJD0NxLK6YHTTwdEZd

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ebdae46a825b4df85070969bae0268618c6ac75d26157f388c9d2aebb5a363d.exe
    "C:\Users\Admin\AppData\Local\Temp\1ebdae46a825b4df85070969bae0268618c6ac75d26157f388c9d2aebb5a363d.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe

    Filesize

    509KB

    MD5

    aa758c3ebc5129d763d4282122264bbf

    SHA1

    b43c9a8142474e82a19ddf3baeecd25605acdb84

    SHA256

    f2c2305564fa48aa613ddc1df7e04ef25b2a1556fb00cba8a73fcf75d67302a9

    SHA512

    c8c4826a6a8eb9dfb809a9d0d931ea5b6c19b04ecc55bc29f0514961387ec977588b3e27c1c4b46d0130fd406d3010e6bd0267eeede879b19a4ec424f97cf6e8

  • memory/956-58-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/956-59-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1320-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1320-57-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB