Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 15:43

General

  • Target

    dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe

  • Size

    425KB

  • MD5

    de8e739e054e0ee9cb3d6f803d957419

  • SHA1

    12cdd7253215512183847ff8c7f7b17a7426c32c

  • SHA256

    dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3

  • SHA512

    09781fde0c514e0d16474e2e94c5f17db5e39b46d1a70653b89d3cc45310bf958c4258ea542148b13c977fffee54acde1048b26da643dc7a05f405db13858ec9

  • SSDEEP

    12288:xCpSZaPeLADixs3Vj7YWOVNqN+sILUZGGQjQ:3gP2AGsFj7tOVNeILUZGGQj

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 27 IoCs
  • Adds Run key to start application 2 TTPs 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
    "C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
      C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
      2⤵
      • Modifies WinLogon for persistence
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
        C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
        3⤵
        • Modifies WinLogon for persistence
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
          C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
          4⤵
          • Modifies WinLogon for persistence
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1492
          • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
            C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
            5⤵
            • Modifies WinLogon for persistence
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:380
            • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
              C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
              6⤵
              • Modifies WinLogon for persistence
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:544
              • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                7⤵
                • Modifies WinLogon for persistence
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:824
                • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                  C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                  8⤵
                  • Modifies WinLogon for persistence
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:584
                  • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                    C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                    9⤵
                    • Modifies WinLogon for persistence
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:1168
                    • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                      C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                      10⤵
                      • Modifies WinLogon for persistence
                      • Adds Run key to start application
                      • Suspicious use of WriteProcessMemory
                      PID:1652
                      • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                        C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                        11⤵
                        • Modifies WinLogon for persistence
                        • Adds Run key to start application
                        • Suspicious use of WriteProcessMemory
                        PID:1560
                        • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                          C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                          12⤵
                          • Modifies WinLogon for persistence
                          • Adds Run key to start application
                          • Suspicious use of WriteProcessMemory
                          PID:2012
                          • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                            C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                            13⤵
                            • Modifies WinLogon for persistence
                            • Adds Run key to start application
                            • Suspicious use of WriteProcessMemory
                            PID:900
                            • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                              C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                              14⤵
                              • Modifies WinLogon for persistence
                              • Adds Run key to start application
                              • Suspicious use of WriteProcessMemory
                              PID:976
                              • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                15⤵
                                • Modifies WinLogon for persistence
                                • Adds Run key to start application
                                • Suspicious use of WriteProcessMemory
                                PID:1828
                                • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                  C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                  16⤵
                                  • Modifies WinLogon for persistence
                                  • Adds Run key to start application
                                  • Suspicious use of WriteProcessMemory
                                  PID:1100
                                  • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                    C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                    17⤵
                                    • Modifies WinLogon for persistence
                                    • Adds Run key to start application
                                    PID:1540
                                    • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                      C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                      18⤵
                                      • Modifies WinLogon for persistence
                                      • Adds Run key to start application
                                      PID:1064
                                      • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                        C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                        19⤵
                                        • Modifies WinLogon for persistence
                                        • Adds Run key to start application
                                        PID:1084
                                        • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                          C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                          20⤵
                                          • Modifies WinLogon for persistence
                                          • Adds Run key to start application
                                          PID:1072
                                          • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                            C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                            21⤵
                                            • Modifies WinLogon for persistence
                                            • Adds Run key to start application
                                            PID:1228
                                            • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                              C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                              22⤵
                                              • Modifies WinLogon for persistence
                                              • Adds Run key to start application
                                              PID:1616
                                              • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                23⤵
                                                • Modifies WinLogon for persistence
                                                • Adds Run key to start application
                                                PID:680
                                                • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                  C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                  24⤵
                                                  • Modifies WinLogon for persistence
                                                  • Adds Run key to start application
                                                  PID:108
                                                  • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                    C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                    25⤵
                                                    • Modifies WinLogon for persistence
                                                    • Adds Run key to start application
                                                    PID:1488
                                                    • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                      C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                      26⤵
                                                      • Modifies WinLogon for persistence
                                                      • Adds Run key to start application
                                                      PID:1832
                                                      • C:\Users\Admin\AppData\Local\Temp\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                        C:\Users\Admin\AppData\Local\Temp\\dd2d6f1aa1f4020a4ab99788c989d4791a8ade596ebab31de0d1fd0d6116d7b3.exe
                                                        27⤵
                                                        • Modifies WinLogon for persistence
                                                        • Adds Run key to start application
                                                        PID:1448

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2028-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

    Filesize

    8KB