Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 11:22

General

  • Target

    7fb21f39a855ffd59d803aa9a0e29acebe5bf2bbd74675f5f77c11040569f29a.exe

  • Size

    362KB

  • MD5

    92c51d07299797c08114c555b0f0bf30

  • SHA1

    6a940fad4c6757fdf472fca9b0c895eaed1b990e

  • SHA256

    7fb21f39a855ffd59d803aa9a0e29acebe5bf2bbd74675f5f77c11040569f29a

  • SHA512

    a81bb41836c2bd64550a3dd9782f001e434e57628d919b6c20cd6879a316946750da55892c4a99adfa33d3cf40f15fb5e7a995a4d58b7edf7770975513c70249

  • SSDEEP

    1536:/t8hTSVcetedkK+uGo8mf6WvQRbXrAwisKld5TJS/xTDDl900gdr3WGr5uisKldR:V8hqc4edf+uTMuQBUV9TCTDRG0cr9ZV

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1384
      • C:\Users\Admin\AppData\Local\Temp\7fb21f39a855ffd59d803aa9a0e29acebe5bf2bbd74675f5f77c11040569f29a.exe
        "C:\Users\Admin\AppData\Local\Temp\7fb21f39a855ffd59d803aa9a0e29acebe5bf2bbd74675f5f77c11040569f29a.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:576
        • C:\Users\Admin\AppData\Local\Temp\7fb21f39a855ffd59d803aa9a0e29acebe5bf2bbd74675f5f77c11040569f29a.exe
          "C:\Users\Admin\AppData\Local\Temp\7fb21f39a855ffd59d803aa9a0e29acebe5bf2bbd74675f5f77c11040569f29a.exe"
          3⤵
            PID:1068

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/576-54-0x0000000075911000-0x0000000075913000-memory.dmp

        Filesize

        8KB

      • memory/576-56-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

      • memory/576-58-0x0000000000230000-0x000000000028B000-memory.dmp

        Filesize

        364KB

      • memory/576-62-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

      • memory/1068-59-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

      • memory/1384-60-0x0000000002200000-0x0000000002201000-memory.dmp

        Filesize

        4KB