Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    23s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 05:03

General

  • Target

    02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe

  • Size

    326KB

  • MD5

    9ca6f79c8a29b38a713fbed495f7f41a

  • SHA1

    327b5ed97b9ef125229a974b3d37a633c5f9a489

  • SHA256

    02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3

  • SHA512

    98ccfec8a980fb10a32ed3620f5d7fd86cb87e02db5e84c84ee25c97e1ec3144b5ba3010ffe4c1f61bc6503320fe7ae0bae5df7a12c2aa38a15a088a1024ba76

  • SSDEEP

    6144:6r4I9uEo2S1YnQmCX492DkwNP3qpYFuT9U1FZA5MRwxuhhfch6clgR:6r4gu6/eIo4nULZKMRwxuPfk6p

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe
    "C:\Users\Admin\AppData\Local\Temp\02bd1816e2676ffe3f5ed6a453518407170102b6859ee368adad0ac98ec3aae3.exe"
    1⤵
    • Loads dropped DLL
    PID:916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\TsuBE82D04D.dll

    Filesize

    50KB

    MD5

    cba3410c80e19fbe5c6fe69d6f2c4179

    SHA1

    ea4204197a98b27aefa01b368a164d4ccf194e70

    SHA256

    89fc85da6e975a419beb1991b46c2bc592fd7af6e72fc034ee15fea5e10eef18

    SHA512

    a9b0771befbe20a3476b3477c2113897e32b004bcc25c1ec040286b0a1c72b4303d878eb7d5f2c70ace707dd7c82dabc7bcbc13acacd88bcd4239cc705772740

  • \Users\Admin\AppData\Local\Temp\{366350C0-A8D3-4526-A7CD-E0F1ED807236}\Custom.dll

    Filesize

    33KB

    MD5

    a5121c57b927d03ec87b24ae5c63ab2c

    SHA1

    2b22c34b7ec62e82128ebac7bd15f692f3265879

    SHA256

    fed1f5d99a486f214b1191e52a8881273f05a97b80a3ebafd0e2eebab12b3832

    SHA512

    0952ace9a3b32c1d33971ec3c2e5d31a89a6416adb645f9adc22c2a156f305a05cebd6fad6f1324f3d63708a76fdfa0b58836f05864511a88c3df04972e93f93

  • \Users\Admin\AppData\Local\Temp\{366350C0-A8D3-4526-A7CD-E0F1ED807236}\_Setup.dll

    Filesize

    44KB

    MD5

    ae1946fabce35a3b6e0a4ade62e7791b

    SHA1

    f1834e5eaf8e65167ba37510feb4f7582f70a04d

    SHA256

    3fa8ac206381ec09614dd359f13e010d1c4d5bf2a82316c4f052237bd40873aa

    SHA512

    ba7c7fe79adcd23c920b9f079a28e7b105ee1519ec011c39ec285ab42a23dfa68edc9bc1e7faca8a382e5a0ee5aba788800bbec224b170657cbb399049992ae0

  • memory/916-55-0x0000000076871000-0x0000000076873000-memory.dmp

    Filesize

    8KB