Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7cd3ba0128...69.exe

windows7-x64

8

7cd3ba0128...69.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    134s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 15:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7cd3ba0128d36bf8f01ab0dcbf2e2d6015c5715b1903f8afa9c2776f89141f69.exe

  • Size

    35KB

  • MD5

    c1da851c8e63032b39428457c77a79a4

  • SHA1

    0a8376f541f34b2a056abbd789a836e2b8290917

  • SHA256

    7cd3ba0128d36bf8f01ab0dcbf2e2d6015c5715b1903f8afa9c2776f89141f69

  • SHA512

    feda0a04f3e9e6734274b74939a867b9d823925a44c06a2e86da96e008ff06dbd111480691f3c8a121e4ccc32c2329ff54cd705c7e7c5c283a44f70949a025ee

  • SSDEEP

    768:ymu+DLDXCh85WepiV4vXXuCMD9CWFjv5Nmt7ICTLpE8XuS:y0DLDXChiHy4vXXuCMD9CWFjv5NmICXL

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cd3ba0128d36bf8f01ab0dcbf2e2d6015c5715b1903f8afa9c2776f89141f69.exe
    "C:\Users\Admin\AppData\Local\Temp\7cd3ba0128d36bf8f01ab0dcbf2e2d6015c5715b1903f8afa9c2776f89141f69.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\cemepro.exe
      C:\Users\Admin\AppData\Local\Temp\cemepro.exe
      2⤵
      • Executes dropped EXE
      • Deletes itself
      PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cemepro.exe
    Filesize

    35KB

    MD5

    0ec5726cf83d2c8b8079e0b58b13168f

    SHA1

    67a8444a92b9dc9146f2c72be927557943f9e28c

    SHA256

    c153f8f920ee389f964eb123c98c48abcea9ee4a635644342e2a9ebc9cab4829

    SHA512

    ca6a3c26e15590fea0b89dfcf804b948a6530f66376302c1d38fdf4d47faba99f4a6792ff266a0dd6d925a40d2c92ce6707550a94a57b281cdfb132015e525a4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cemepro.exe
    Filesize

    35KB

    MD5

    0ec5726cf83d2c8b8079e0b58b13168f

    SHA1

    67a8444a92b9dc9146f2c72be927557943f9e28c

    SHA256

    c153f8f920ee389f964eb123c98c48abcea9ee4a635644342e2a9ebc9cab4829

    SHA512

    ca6a3c26e15590fea0b89dfcf804b948a6530f66376302c1d38fdf4d47faba99f4a6792ff266a0dd6d925a40d2c92ce6707550a94a57b281cdfb132015e525a4

    Download Submit

  • \Users\Admin\AppData\Local\Temp\cemepro.exe
    Filesize

    35KB

    MD5

    0ec5726cf83d2c8b8079e0b58b13168f

    SHA1

    67a8444a92b9dc9146f2c72be927557943f9e28c

    SHA256

    c153f8f920ee389f964eb123c98c48abcea9ee4a635644342e2a9ebc9cab4829

    SHA512

    ca6a3c26e15590fea0b89dfcf804b948a6530f66376302c1d38fdf4d47faba99f4a6792ff266a0dd6d925a40d2c92ce6707550a94a57b281cdfb132015e525a4

    Download Submit

  • memory/1472-59-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1472-60-0x0000000075451000-0x0000000075453000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2020-57-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download