Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 10:05

General

  • Target

    d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe

  • Size

    96KB

  • MD5

    95e321e13ac9f159721cad66c95c5c1a

  • SHA1

    ac55a4495266ddb0ba5e5c4e072a5ad08c3e6415

  • SHA256

    d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9

  • SHA512

    e85d557362df0b93dd0bf7a5de42cd2ae02d5aa9fb772de6c8a073451ecfc15af7ffcaece07a9b73ebd4b474aaa32a500d27c2da0dbeebdb27eadac97c68bd4e

  • SSDEEP

    1536:I8kcu4l7dSZ9T+2mxPAsL/JbuOLZ64ZCPBKbnziw1dVOcwCCQc+VDM+QJtOw/:ecj7k/y2mxB9uMzZCPBK1Dw9Raw/

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe
    "C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe
      C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Users\Admin\AppData\Roaming\taskhost.exe
        C:\Users\Admin\AppData\Roaming\taskhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:608
        • C:\Users\Admin\AppData\Roaming\taskhost.exe
          C:\Users\Admin\AppData\Roaming\taskhost.exe
          4⤵
          • Executes dropped EXE
          PID:1140

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\taskhost.exe

    Filesize

    96KB

    MD5

    9163eccf4f38ee5681d275767d7d9103

    SHA1

    c0975d49b43ad9157f50dd56aac8a5d113ee0775

    SHA256

    2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

    SHA512

    b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

  • C:\Users\Admin\AppData\Roaming\taskhost.exe

    Filesize

    96KB

    MD5

    9163eccf4f38ee5681d275767d7d9103

    SHA1

    c0975d49b43ad9157f50dd56aac8a5d113ee0775

    SHA256

    2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

    SHA512

    b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

  • C:\Users\Admin\AppData\Roaming\taskhost.exe

    Filesize

    96KB

    MD5

    9163eccf4f38ee5681d275767d7d9103

    SHA1

    c0975d49b43ad9157f50dd56aac8a5d113ee0775

    SHA256

    2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

    SHA512

    b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

  • \Users\Admin\AppData\Roaming\taskhost.exe

    Filesize

    96KB

    MD5

    9163eccf4f38ee5681d275767d7d9103

    SHA1

    c0975d49b43ad9157f50dd56aac8a5d113ee0775

    SHA256

    2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

    SHA512

    b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

  • \Users\Admin\AppData\Roaming\taskhost.exe

    Filesize

    96KB

    MD5

    9163eccf4f38ee5681d275767d7d9103

    SHA1

    c0975d49b43ad9157f50dd56aac8a5d113ee0775

    SHA256

    2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

    SHA512

    b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

  • memory/1140-75-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1988-54-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1988-60-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1988-59-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

    Filesize

    8KB

  • memory/1988-56-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1988-74-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB