Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    30/11/2022, 23:32

General

  • Target

    e05dca9d0ba628d36e4b774f9f12a21f9eadf4e0a12bf214f7ad274549d98605.exe

  • Size

    839KB

  • MD5

    00f91624b385c724df8dde41d16d1761

  • SHA1

    9bb59332d31e3f940bef49472230959c1f6487cd

  • SHA256

    e05dca9d0ba628d36e4b774f9f12a21f9eadf4e0a12bf214f7ad274549d98605

  • SHA512

    1a88e4a7774a670cd021c9c0bd9ff850718fcc834bb8688871647823bd49be28c1bdb296aba77ad9f44c027783d071f792a19f5cff8db93e3a9b9385d2e8c432

  • SSDEEP

    24576:UsBbWOSY4HewnvFdjaKDDh694uYk5SfZeE:UqL4BnvXjF0HYbeE

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e05dca9d0ba628d36e4b774f9f12a21f9eadf4e0a12bf214f7ad274549d98605.exe
    "C:\Users\Admin\AppData\Local\Temp\e05dca9d0ba628d36e4b774f9f12a21f9eadf4e0a12bf214f7ad274549d98605.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:2012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe

    Filesize

    843KB

    MD5

    299c3f1fbc6c3a69af612ac663379da4

    SHA1

    9132a844d27e8cef3d31ca90365cc6376896aab8

    SHA256

    2f959c91c1fff988450e5ae55fbf4c6e5753acd06e44b58953d972344b1d6a50

    SHA512

    6cd5539f436373810c0510a11ae344900ce2e6c1b741f202bfcdae3cf5463e50cb98b521cf38ca7623d2b106e5f5ec59201a0f8e7c51b231e6253a7278a58eb4

  • memory/1220-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1220-57-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2012-58-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2012-59-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB