Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 08:36

General

  • Target

    ef93a4bace831b4776f38a843bf4c53561d5314d653a4e27fc09ae448f606995.exe

  • Size

    315KB

  • MD5

    0e65a24627a892cec97edbbfe21df7b9

  • SHA1

    81a6b428b27ef454d0c87a9ab4c7771db464a8c2

  • SHA256

    ef93a4bace831b4776f38a843bf4c53561d5314d653a4e27fc09ae448f606995

  • SHA512

    4bf4cfb4649eb8cb74b3413a5ce11c5d0315faee1177c628c596121a4d83795a8d35247c385698fe4bb1d2efc19798413cc397b6708e8b021f5f25bd8839321e

  • SSDEEP

    6144:zr3bUzkuvcBYC47l2xiFjox21H9mbWnqnHB/Jc9BItkszgx4ygDA:zrckuveY3fFj4ThVkszC4yh

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef93a4bace831b4776f38a843bf4c53561d5314d653a4e27fc09ae448f606995.exe
    "C:\Users\Admin\AppData\Local\Temp\ef93a4bace831b4776f38a843bf4c53561d5314d653a4e27fc09ae448f606995.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1536

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\TsuD225ECF9.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{36FB2B93-0DC1-40FD-A216-45E3ED180965}\Custom.dll

    Filesize

    91KB

    MD5

    c28c3116543d19ffee5966b48581b7ed

    SHA1

    22b079cbdf1296ca1bc94f01dde55ea5564b1023

    SHA256

    d4ca435fbb22d5df35a1cc01fee202e9c74fa57f63de8d9b7bf332aa32234bbd

    SHA512

    f49da550af68e6c1862e7876ea87227f1aa80c4cd6b3072167355fba70ba35a5cf9bc56adbd21dc67fa9fcca36fe732f7689006463b82931722996accdc796aa

  • \Users\Admin\AppData\Local\Temp\{36FB2B93-0DC1-40FD-A216-45E3ED180965}\_Setup.dll

    Filesize

    173KB

    MD5

    aef1a3ee471bad9c1afdd55d8393022a

    SHA1

    4ecb4e71e29e61ce49fe4a473a536bb83f692343

    SHA256

    14a536918883f8f84d5fdb44ba52c947d0a52f7f56230c5760dc1af1ce141297

    SHA512

    967882acad88612dd1a7109a360100d6d631761034d0241e01cb2e454bee7a4f149e75b4240dc284a9e0c155cf16c9849ab0157016199ddce026647f15a23835

  • memory/1536-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

    Filesize

    8KB