Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 10:02

General

  • Target

    d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe

  • Size

    183KB

  • MD5

    2151c09c1db2a9a08ca36b2c77c84630

  • SHA1

    e104bb0bf94d0b48c2d9751ed6e1cac442e5b46c

  • SHA256

    d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878

  • SHA512

    fb59dd97098d932ead43bd8783ecbfb6ef04c54c94035d41a502e3636009a3bab106d72e0b8f5425f2bfad9ccd02a78d6e77b2f367b43a8559e30b4c376d9159

  • SSDEEP

    3072:WhZMMCvQj0eTvmQM3gu+lJw+uL8mhbqIXE/iOMHg2c8uXsAV:kZmUXTvmQgguDLOixHg2c8iV

Malware Config

Signatures

  • ASPack v2.12-2.42 5 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe
    "C:\Users\Admin\AppData\Local\Temp\d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\16b04c30.exe
      C:\16b04c30.exe
      2⤵
      • Executes dropped EXE
      • Sets DLL path for service in the registry
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1952
  • C:\Windows\SysWOW64\Svchost.exe
    C:\Windows\SysWOW64\Svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1768

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\16b04c30.exe

    Filesize

    143KB

    MD5

    d4b4d82ddb32ea8de49571df94b08e14

    SHA1

    7f0702725855422e5ded1dd247522ccb982b162e

    SHA256

    f9e7662a3eee2174d38ca7b6b598120861aab6456d1bf9da74f8b3e9dabec340

    SHA512

    cafd822d17eb7ce96f21570329ca223bf7e8f5cdebd4705fd8fe1b7828b0d40d6a0b2c909fc5f561890787a9f7ccb2d3bf77c578019227cd7ff6a4902c49d256

  • C:\16b04c30.exe

    Filesize

    143KB

    MD5

    d4b4d82ddb32ea8de49571df94b08e14

    SHA1

    7f0702725855422e5ded1dd247522ccb982b162e

    SHA256

    f9e7662a3eee2174d38ca7b6b598120861aab6456d1bf9da74f8b3e9dabec340

    SHA512

    cafd822d17eb7ce96f21570329ca223bf7e8f5cdebd4705fd8fe1b7828b0d40d6a0b2c909fc5f561890787a9f7ccb2d3bf77c578019227cd7ff6a4902c49d256

  • C:\Users\Infotmp.txt

    Filesize

    720B

    MD5

    da03aa0be64504edb0884ce0eae258d7

    SHA1

    e100d24f88a0ae9f85562996b612c1024e9fc610

    SHA256

    0dad20c35559e58b0a559abbc3a3acecd916d4304aef07f73b32be78f11769dd

    SHA512

    530d4c496d5514f213cb6bb2f3df4370348617582f05c35fc8d2f42761baa1b4e21dabd6df57b462b68b86280859270c07c8d271bafc0024f49e6d10b4320ada

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    143KB

    MD5

    ab5db2af8f8e8f5ce0defc51d21e8963

    SHA1

    577e8eb5d7f97eed02a18704b30dfff7eac1260a

    SHA256

    4ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce

    SHA512

    e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa

  • \Windows\SysWOW64\0EFD04C4.tmp

    Filesize

    143KB

    MD5

    ab5db2af8f8e8f5ce0defc51d21e8963

    SHA1

    577e8eb5d7f97eed02a18704b30dfff7eac1260a

    SHA256

    4ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce

    SHA512

    e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa

  • \Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    143KB

    MD5

    ab5db2af8f8e8f5ce0defc51d21e8963

    SHA1

    577e8eb5d7f97eed02a18704b30dfff7eac1260a

    SHA256

    4ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce

    SHA512

    e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa

  • memory/1768-72-0x00000000744B0000-0x00000000744D4000-memory.dmp

    Filesize

    144KB

  • memory/1768-70-0x00000000744B0000-0x00000000744D4000-memory.dmp

    Filesize

    144KB

  • memory/1768-69-0x00000000744B0000-0x00000000744D4000-memory.dmp

    Filesize

    144KB

  • memory/1952-57-0x0000000000F20000-0x0000000000F44000-memory.dmp

    Filesize

    144KB

  • memory/1952-64-0x0000000002350000-0x0000000006350000-memory.dmp

    Filesize

    64.0MB

  • memory/1952-65-0x0000000074CA0000-0x0000000074D00000-memory.dmp

    Filesize

    384KB

  • memory/1952-63-0x0000000000F20000-0x0000000000F44000-memory.dmp

    Filesize

    144KB

  • memory/1952-58-0x0000000000F20000-0x0000000000F44000-memory.dmp

    Filesize

    144KB

  • memory/1952-73-0x0000000074CA0000-0x0000000074D00000-memory.dmp

    Filesize

    384KB

  • memory/1952-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

    Filesize

    8KB

  • memory/1976-62-0x0000000000F20000-0x0000000000F44000-memory.dmp

    Filesize

    144KB

  • memory/1976-61-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB