Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    88s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 03:19

General

  • Target

    afe6507bd32451a8174c77bfc87620dc155d69024eeaa0ea2fcc56b00dcc464d.exe

  • Size

    327KB

  • MD5

    05819eaf6ccd03c815663de145f94ae7

  • SHA1

    57653d05b2a2d16ccedbf709c78b5a61fb786c20

  • SHA256

    afe6507bd32451a8174c77bfc87620dc155d69024eeaa0ea2fcc56b00dcc464d

  • SHA512

    be09cd9eb88d8976f3386a96eaf2dba67c85b6fcd612cc71e8f9768a72529fd9448adce8333449b4e0bf1cfb54c43890324562270dd828a0cfcba7dea06ac74d

  • SSDEEP

    6144:0rpbUzkuvcBYC47l2xKYEti5hHHQ9qZGoBRonSUIDdpK6KMydWj:0rakuveY3PYT5xQrdVUbK6KMydm

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\afe6507bd32451a8174c77bfc87620dc155d69024eeaa0ea2fcc56b00dcc464d.exe
    "C:\Users\Admin\AppData\Local\Temp\afe6507bd32451a8174c77bfc87620dc155d69024eeaa0ea2fcc56b00dcc464d.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu9D9A27D3.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{8060CA44-C018-461D-A4F6-883A5B83E8B2}\Custom.dll

    Filesize

    91KB

    MD5

    14d03f73377c34394451d39fa8364c2c

    SHA1

    4312e7abcb79d9d1b4106829fc8290a3df92450a

    SHA256

    77cf95ad8bca51aa6c93805bbeace6eeb40b1b1582c4ddddda7d738359ab523f

    SHA512

    faad5e2d39bd94b36e5a58202e8d7c12ede73c9597d4077d38bc30ce15b32ba4e36769b1bec35bceba2500532ff97dd9da2d8e834042fd723d3d162f9bc2a46a

  • \Users\Admin\AppData\Local\Temp\{8060CA44-C018-461D-A4F6-883A5B83E8B2}\_Setup.dll

    Filesize

    183KB

    MD5

    9e898ffdc682cf853f7df237678a6f3a

    SHA1

    55cacb14771890e8028a8a9ce8ae936dff17944f

    SHA256

    e78f957aceb637683a41b00dd094d4e88f706b94fd7b679b35add56269e4d047

    SHA512

    942746351a7c0f43f633a4732ca54404b4d8e767616ffe724e265359506375f9c3b5c3a84a46b3ec452ae4b5d80a966d3b6b5aa0161c2150db39cb84c588a9d0

  • memory/1956-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

    Filesize

    8KB