Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 15:40

General

  • Target

    3cbef34cc3a5c296f343b0f87f96f77c6d4cad5dc73e79ac660a50630474c73a.exe

  • Size

    184KB

  • MD5

    04a894f696c11abeb77b5f845159b7f1

  • SHA1

    705bb4f77ef157b177fe5cfc75e406338b032173

  • SHA256

    3cbef34cc3a5c296f343b0f87f96f77c6d4cad5dc73e79ac660a50630474c73a

  • SHA512

    a1042177f6d3f0bf079c5fbb37eeb8070c49da604d4ba6937f757b4d402bbae254f1f76adb024192dcfa55cc05f4b8732f4df0034a59705d523cc1e4491086cd

  • SSDEEP

    3072:MRAhhcsxgAJuK7bZD01GoI0ON27Usy3/ROzTU9YMftqr40hteO4UNuTEHEgi+IgT:MRAhhJxX7bNIAROzTuft840hkkPJFT

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cbef34cc3a5c296f343b0f87f96f77c6d4cad5dc73e79ac660a50630474c73a.exe
    "C:\Users\Admin\AppData\Local\Temp\3cbef34cc3a5c296f343b0f87f96f77c6d4cad5dc73e79ac660a50630474c73a.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:1116

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe

    Filesize

    188KB

    MD5

    5399c4b7601839d8e99e3cfcc663e4d0

    SHA1

    d365a7c237a555fbfe26e8148b06d4c89a41c304

    SHA256

    7abf826083369ef17d37c8ff25cb6f386749975816e1f744301508d049b9037e

    SHA512

    c6f5f4943440372773cef86154d601dbf05f0c73c1eaf8d4dd83dd396db4f94526c86b7da6dac55604c996720e33c64477d06641257aa36f44edc2b37028c038

  • memory/112-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/112-56-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1116-58-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1116-59-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB