Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 17:50

General

  • Target

    ccae39969b7d8dcb47b185153189cf3040a6be924dc27fc27c4c6ecb6bfe760f.exe

  • Size

    255KB

  • MD5

    2a474a520549e30f10938a2f631aafbd

  • SHA1

    de043955fd47258fa9a83dcfb24e6d4d1ba03db4

  • SHA256

    ccae39969b7d8dcb47b185153189cf3040a6be924dc27fc27c4c6ecb6bfe760f

  • SHA512

    212947f7b47615df6e8f73dcd9d36280221d0346b21e7618850d8e7e83e8247258ad2a576856f1a544d5e1851a68c5d70071a8d3b3a1f74a2c18b93c9bc72c60

  • SSDEEP

    6144:MRAhhJxX7bNIAROzTbdaOUdSehom5x1uszzSF+J:UsAAMHUgYoI3zzSF+J

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccae39969b7d8dcb47b185153189cf3040a6be924dc27fc27c4c6ecb6bfe760f.exe
    "C:\Users\Admin\AppData\Local\Temp\ccae39969b7d8dcb47b185153189cf3040a6be924dc27fc27c4c6ecb6bfe760f.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:1332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe

    Filesize

    259KB

    MD5

    806b750f86559f328f51afe7710464ac

    SHA1

    0b2013dd72eaa8a5f9eb338f402a23a450ea2ce9

    SHA256

    4531199e8303980aa741fb6944f3ec4e27b5f5a110f3d49c0f35cc3a794850cb

    SHA512

    4c2fd5d46e7ced3039bd7d360bbeb2b1135a6b44ef3cfc6771d6d1fd19ad796387c40b6b61ad334b68df7dc368fe691ffcfb0cf4311932f9eda8d97cfb880712

  • memory/1332-58-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1332-59-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1768-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1768-56-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB