Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    89s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 06:57

General

  • Target

    c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe

  • Size

    157KB

  • MD5

    7d1ed080cf48dc127655f0edc91450e1

  • SHA1

    67735ea2edc526b053a0055b59bc46224f4cf2e1

  • SHA256

    c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84

  • SHA512

    10aa22227c78eb854937a1486857ebe6930f9377c5d15456dff611dd1c8be1a9e784928918b6897ef0a911e6dccae70cc149964f7cfb8d11310046ec49bf0c8c

  • SSDEEP

    3072:ladYAFNbRRNliiJ8kGTkQv/pOmo4FyqwgCyKY8Xb8Y+o/:l9A3trliiieIRO5mVYn

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe
    "C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /e:on /d /c ping -n 6 127.0.0.1 && DEL /F "C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe" >> nul
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 6 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1772-54-0x0000000075981000-0x0000000075983000-memory.dmp

    Filesize

    8KB

  • memory/1772-55-0x00000000003E0000-0x000000000042F000-memory.dmp

    Filesize

    316KB