Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    7s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 03:10

General

  • Target

    18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe

  • Size

    500KB

  • MD5

    58be79e04e910cdc25d0353728f95d60

  • SHA1

    e333cf6455416da942cd77a86c40b5b4f55a1a63

  • SHA256

    18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4

  • SHA512

    950787d67e33d113c0bb727a5039ddcb4ff7f336fd1e65c79f803105cb76b0c5f89a518e78b742af4973970aacd25a825ae8b8af5e192cc2e49abd592612c15d

  • SSDEEP

    12288:5MTb0PQ0vyj70pGufmLNMZZW/an1sVsz/:CTb0PQ0vI0LmLiLWCn1

Score
1/10

Malware Config

Signatures

  • Kills process with taskkill 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe
    "C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1712
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1712 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe" & start C:\Users\Admin\AppData\Local\JNPXMB~1.EXE -f
      2⤵
        PID:2024
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 3 127.1
          3⤵
          • Runs ping.exe
          PID:1824
        • C:\Users\Admin\AppData\Local\jnpxmbmea.exe
          C:\Users\Admin\AppData\Local\JNPXMB~1.EXE -f
          3⤵
            PID:520
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /pid 1712
        1⤵
        • Kills process with taskkill
        PID:2040

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\jnpxmbmea.exe

        Filesize

        23KB

        MD5

        7aa4d9e242d437f0ae7472a94565e0cf

        SHA1

        30de37ca0243ac7c0733b518816098543556ebfc

        SHA256

        7d939e4af226deb56b83df2f3b26c1a24adcb46d5087a20c7668f13077215b28

        SHA512

        99e43c3f68d36da923a65d1c18ce36e461581816d9cf9e2d1094a282d160cba4c8e3d6185a0cd4b74f6d2d699d9610ee1bb720c5942a64778385fbade34aad4a

      • C:\Users\Admin\AppData\Local\jnpxmbmea.exe

        Filesize

        16KB

        MD5

        dde25b695734f4b047572428434acf9c

        SHA1

        29aa394ebd7cbd92689c08ccee155a64fcf0e0a6

        SHA256

        64c2504b9e699e81753df8f7d3d4ee5653a2caa922c6fba5f6e68ef83d76ef3d

        SHA512

        d633c4d12ef474db950a227ebfc26a6f250a1750b8cb97a7f3e2e4e21dd3d2cccf38578c31b4ee616a1f6d1ec0138a721f582ec31d617605d623a065e08e8ae6

      • \Users\Admin\AppData\Local\jnpxmbmea.exe

        Filesize

        21KB

        MD5

        90b1b0764f93e38aaca946ed5d03797c

        SHA1

        dc4aacfde12b27c06bfc389a4cfe4e6fdfe8c899

        SHA256

        b752af84e3e24a0670412cdcbd6786db806413658c757de01ad2f8a0f8a0a422

        SHA512

        176f8003d19f58925389591a52a1b9609a0c999fafe9cb0f110d28af00aed2b36d8625f3c19dee907f6a7180b2243d10cf088e330514dc384deae0150b9e1038

      • \Users\Admin\AppData\Local\jnpxmbmea.exe

        Filesize

        28KB

        MD5

        1d10ea226b7f34e3a9a70f1a5563e8fd

        SHA1

        2266185822d46fa6b6ffc022f1ab0c508b07568a

        SHA256

        d475b4fd671468871cc883bcad813fefa725a306b3a02f2b0d08df4df4a39424

        SHA512

        138dda9803746b12224ed01317483eafb9f566f8b0eefa60838e6a2cfb5a18f2867dea7164f0925fcaa1d501b1b9164852d2557d3889c0f8fac4732771d729be

      • memory/1712-54-0x0000000075071000-0x0000000075073000-memory.dmp

        Filesize

        8KB

      • memory/1712-58-0x0000000001000000-0x00000000010A9000-memory.dmp

        Filesize

        676KB

      • memory/1712-57-0x00000000002D0000-0x00000000002D6000-memory.dmp

        Filesize

        24KB