Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    38s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 23:22

General

  • Target

    6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe

  • Size

    46KB

  • MD5

    54381de81140a945cf0590e6be01de27

  • SHA1

    dd81318257831a988f757a193510659236e18ef5

  • SHA256

    6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed

  • SHA512

    344eadeeb3f7e9c9e9fad0cb79d243b3844652f914b9605021034713141195a9967e61ae9f79fce51c4b628b0dd25c1bd6d71301a62805cfafa3f4c994f41de3

  • SSDEEP

    768:8RRtzKvojqXl5JkRJRuovHZ+k9Oi2KTBkd6nNMI6pQE7B:ARqjpgui5+k9Oi2bcNF+Qi

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe
    "C:\Users\Admin\AppData\Local\Temp\6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\0438206.tmp
      "C:\Users\Admin\AppData\Local\Temp\0438206.tmp"
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\0438206.tmp"
        3⤵
          PID:636
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe"
        2⤵
        • Deletes itself
        PID:1732

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\0438206.tmp

      Filesize

      46KB

      MD5

      31a204ee319fdf730754a0b10ae24815

      SHA1

      1ad218654c868bb1fe8946ff9ebd0f19297559bd

      SHA256

      8adbfdd30f501559475a6f075009634abf15bd779e4cccb1428dfb16c92b8d84

      SHA512

      ab86107ddfd6bff3ed8424daeb36ba8028d4bc115d2d5283470c456dadad8f62a638b1ee30f148b6e06bbd17eb29f121478417aee1935ed239717a6657b5e38b

    • \Users\Admin\AppData\Local\Temp\0438206.tmp

      Filesize

      46KB

      MD5

      31a204ee319fdf730754a0b10ae24815

      SHA1

      1ad218654c868bb1fe8946ff9ebd0f19297559bd

      SHA256

      8adbfdd30f501559475a6f075009634abf15bd779e4cccb1428dfb16c92b8d84

      SHA512

      ab86107ddfd6bff3ed8424daeb36ba8028d4bc115d2d5283470c456dadad8f62a638b1ee30f148b6e06bbd17eb29f121478417aee1935ed239717a6657b5e38b

    • \Users\Admin\AppData\Local\Temp\0438206.tmp

      Filesize

      46KB

      MD5

      31a204ee319fdf730754a0b10ae24815

      SHA1

      1ad218654c868bb1fe8946ff9ebd0f19297559bd

      SHA256

      8adbfdd30f501559475a6f075009634abf15bd779e4cccb1428dfb16c92b8d84

      SHA512

      ab86107ddfd6bff3ed8424daeb36ba8028d4bc115d2d5283470c456dadad8f62a638b1ee30f148b6e06bbd17eb29f121478417aee1935ed239717a6657b5e38b

    • memory/1852-60-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/1852-61-0x0000000075521000-0x0000000075523000-memory.dmp

      Filesize

      8KB

    • memory/1852-63-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB

    • memory/2036-59-0x0000000000400000-0x000000000040F000-memory.dmp

      Filesize

      60KB