Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 19:23

General

  • Target

    ee0bfc195dd7c663ae614cc543b36180a7dba0f9e42c0e430584617afe61b4b4.exe

  • Size

    327KB

  • MD5

    574e062043108cdd92adb7641b5d2140

  • SHA1

    c50461a4baf1bcc6863fb1b55e6e66c883dc3e3a

  • SHA256

    ee0bfc195dd7c663ae614cc543b36180a7dba0f9e42c0e430584617afe61b4b4

  • SHA512

    233456eb2620e3a98a59f13603ca1815cbf728792c6bdb89f9075bbd61871e148d124e87f4b4d8317f545a47c1e100ef0fae9f9f2b5562047b7ca677e692652f

  • SSDEEP

    6144:VrVbUzkuvcBYC47l2xt81bM31jFryMm/+3pZasr0AtbgTtCybrNMcO:VrGkuveY38aExzr3pZh0d8EJ9O

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee0bfc195dd7c663ae614cc543b36180a7dba0f9e42c0e430584617afe61b4b4.exe
    "C:\Users\Admin\AppData\Local\Temp\ee0bfc195dd7c663ae614cc543b36180a7dba0f9e42c0e430584617afe61b4b4.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1432

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu399E5808.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{77559AD3-C008-41AB-A340-882AACB6B825}\Custom.dll

    Filesize

    91KB

    MD5

    39f481c407d7f058a25e6912e14277db

    SHA1

    78cc70caffb228462643529b4cedc186afc5854a

    SHA256

    01432d2af2cffef96ef2338f55f9ca3aca629ca5411ef0c51e1a83c6bf051713

    SHA512

    e9126bd5e1d22ff054f20c9e97bc4344b57dce0470ebe61dd2a550991ee658d46e88367e0dfc060d5435e78705779ab1423a819ed385445e9b7a6750fbd4038f

  • \Users\Admin\AppData\Local\Temp\{77559AD3-C008-41AB-A340-882AACB6B825}\_Setup.dll

    Filesize

    183KB

    MD5

    9e898ffdc682cf853f7df237678a6f3a

    SHA1

    55cacb14771890e8028a8a9ce8ae936dff17944f

    SHA256

    e78f957aceb637683a41b00dd094d4e88f706b94fd7b679b35add56269e4d047

    SHA512

    942746351a7c0f43f633a4732ca54404b4d8e767616ffe724e265359506375f9c3b5c3a84a46b3ec452ae4b5d80a966d3b6b5aa0161c2150db39cb84c588a9d0

  • memory/1432-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

    Filesize

    8KB