Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:58

General

  • Target

    a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe

  • Size

    124KB

  • MD5

    2f200b6aaa6165f19d71513d311d9037

  • SHA1

    469c214cc5fcf2b00fdbcccefff936ce4b946c31

  • SHA256

    a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

  • SHA512

    9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

  • SSDEEP

    3072:ca4B5eRp47aJgZeqct7WBB5NcIpomk8fHDJsBqoN1NjbgSn:E524De9UyIpoPOHVOq4rbgSn

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe
    "C:\Users\Admin\AppData\Local\Temp\a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe
      C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      PID:1708

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

    Filesize

    124KB

    MD5

    2f200b6aaa6165f19d71513d311d9037

    SHA1

    469c214cc5fcf2b00fdbcccefff936ce4b946c31

    SHA256

    a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

    SHA512

    9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

  • C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

    Filesize

    124KB

    MD5

    2f200b6aaa6165f19d71513d311d9037

    SHA1

    469c214cc5fcf2b00fdbcccefff936ce4b946c31

    SHA256

    a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

    SHA512

    9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

  • \Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

    Filesize

    124KB

    MD5

    2f200b6aaa6165f19d71513d311d9037

    SHA1

    469c214cc5fcf2b00fdbcccefff936ce4b946c31

    SHA256

    a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

    SHA512

    9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

  • \Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

    Filesize

    124KB

    MD5

    2f200b6aaa6165f19d71513d311d9037

    SHA1

    469c214cc5fcf2b00fdbcccefff936ce4b946c31

    SHA256

    a662077b200ed65f66af21385833f68de91a86be512fc30b06a006bc6837d78d

    SHA512

    9a4f84a9735ac5d1ae60e9e6eed23d5855b3f7862cde5cb272844d98d49b88ca0106c77d48e30cd3774458757cfb8f8a8c3e14c6e68b6721dba01959ccb8b8a4

  • memory/1708-67-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/1708-66-0x0000000000A40000-0x0000000000B63000-memory.dmp

    Filesize

    1.1MB

  • memory/1708-65-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/1904-57-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/1904-63-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/1904-54-0x0000000000400000-0x0000000000522000-memory.dmp

    Filesize

    1.1MB

  • memory/1904-56-0x00000000762D1000-0x00000000762D3000-memory.dmp

    Filesize

    8KB

  • memory/1904-55-0x0000000000720000-0x0000000000843000-memory.dmp

    Filesize

    1.1MB