Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 16:25

General

  • Target

    51194f1011cc7a7f305f15c12f2f7e6fb61fc488e137c24206e8cf9f47fce7e7.exe

  • Size

    316KB

  • MD5

    20fcc58c4f8c0672604780fe5100b6f0

  • SHA1

    ea64ff728d978ffe13cac8c73ae8e378b84cd3b6

  • SHA256

    51194f1011cc7a7f305f15c12f2f7e6fb61fc488e137c24206e8cf9f47fce7e7

  • SHA512

    67b976078e6c3dd8e849ed124bb8bd88fb6524e5e3f141d632968eef3a313745d283ebdba6b0ee56091ba3d69e615c4ed72e61c329c4590a2c73cc4d06d6e8ee

  • SSDEEP

    6144:wrabUzkuvcBYC47l2x1V/GgGyjAj43W9jXdpcDfUEA1Ktm+:wrDkuveY3SV/dK4gjrcV7tD

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51194f1011cc7a7f305f15c12f2f7e6fb61fc488e137c24206e8cf9f47fce7e7.exe
    "C:\Users\Admin\AppData\Local\Temp\51194f1011cc7a7f305f15c12f2f7e6fb61fc488e137c24206e8cf9f47fce7e7.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4496

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TsuA78E761D.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{9B5068A4-3C0E-4D0A-AFE1-742C40B34A52}\Custom.dll

    Filesize

    91KB

    MD5

    f2730fc32e76d67606196bf8322d4370

    SHA1

    168a3f2b9ab8c712b98ac0288ab012784d6224d4

    SHA256

    8148abbb512c6a95c41611d6b7618ae8eb92523310eea8a4e2ab38a513ac4e2a

    SHA512

    7d46f78938bfb86db07298cad39f7360c1753cfe2c5f9b8f274151bc8fe9253bb7daa0a437a8cc2101a3a90e42366e8328c61cbefdc68bc1345869e0d853f8bb

  • C:\Users\Admin\AppData\Local\Temp\{9B5068A4-3C0E-4D0A-AFE1-742C40B34A52}\_Setup.dll

    Filesize

    173KB

    MD5

    f726d8f3cc6b1033001ba21fbaf22655

    SHA1

    f0a3cb4042adb0ea429d6d000e9a66a79497d0eb

    SHA256

    fcb344c1a1c7eee395a023e4d9534e96c6b86c130886bf7a62e3e8ccef1e5f75

    SHA512

    10a6609e29d6cded049e70eb57e5941e77c5daaeb8547d3f46258f73fcc5d5f5305602212de313bf6dd15cdefb053ac09ecbb91fee75cb0dcac8ade241140270