Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    23s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2022, 22:55

General

  • Target

    0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.exe

  • Size

    2.1MB

  • MD5

    7cbfe384ab73c87c8c915121d808cb2f

  • SHA1

    dc2727ed544ab9544a5e1f3174f959e7f35b20e4

  • SHA256

    0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48

  • SHA512

    64e678180ccbd2c9085b75b8a23fdb4ae5c3af9d4ce5fe13b5bbb77d6c40dd426171c9c03813a1fc36b7520a29976f3f18759a6984bacc7c644bc1f117db15d0

  • SSDEEP

    49152:aaGGzyuP7BQo2d1unAn8HzXD3Jc5k6wsY2jnCwn53u9TDam:TG/uzBQoeuzzXD5c5k60qnCwnA93

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.exe
    "C:\Users\Admin\AppData\Local\Temp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Users\Admin\AppData\Local\Temp\is-4DH3V.tmp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4DH3V.tmp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.tmp" /SL5="$60124,1946005,54784,C:\Users\Admin\AppData\Local\Temp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-4DH3V.tmp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.tmp

    Filesize

    687KB

    MD5

    8f144bcbcad0417e7823dd8e60218530

    SHA1

    9df092a764b8ad278ed574f00d1c065683eef6ac

    SHA256

    39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0

    SHA512

    e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

  • C:\Users\Admin\AppData\Local\Temp\is-4DH3V.tmp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.tmp

    Filesize

    687KB

    MD5

    8f144bcbcad0417e7823dd8e60218530

    SHA1

    9df092a764b8ad278ed574f00d1c065683eef6ac

    SHA256

    39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0

    SHA512

    e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

  • \Users\Admin\AppData\Local\Temp\is-40BJU.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-40BJU.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-4DH3V.tmp\0181ff42f8ea4dd625560b4bc7ae7de9594b76a86b779f76a67efe23a2560f48.tmp

    Filesize

    687KB

    MD5

    8f144bcbcad0417e7823dd8e60218530

    SHA1

    9df092a764b8ad278ed574f00d1c065683eef6ac

    SHA256

    39dfa032878743bba8244c73173c263e669131f0084a38f22c52b1383f627ba0

    SHA512

    e093f69030fee17d8b55bde8337d409e8dfb583c97a81ed37425fb72122318d4c1f996d0d1bca28f24182ff5c8afe2be25eadc27951463ddca5c0abceca2a72d

  • memory/1452-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

    Filesize

    8KB

  • memory/1452-55-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1452-64-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB