Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 16:26

General

  • Target

    e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe

  • Size

    356KB

  • MD5

    16992477af6c1128ccf8e2bb7d41b165

  • SHA1

    f0a8f7bc308ee177dd83df0f573a2ea6654be847

  • SHA256

    e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36

  • SHA512

    9cb37d03753d1ccdaaf9952d64b1d6ec671e86d509e77e48137d13ea4afad452c7a413e7fc1d9231da253198e7d7d5756c702ebe176be9d7de276ba946a42117

  • SSDEEP

    6144:7vbx8OOArW84uuJTVZS0EMja2G6dJfoWSXlAiETbld6stREj:7LO2dsFjc6Q7GlFRs

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
    "C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe
      "C:\Users\Admin\AppData\Local\Temp\e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\ProgramData\tzKzFt08skl5\sQQOjOTB.exe
        "C:\ProgramData\tzKzFt08skl5\sQQOjOTB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\ProgramData\tzKzFt08skl5\sQQOjOTB.exe
          "C:\ProgramData\tzKzFt08skl5\sQQOjOTB.exe"
          4⤵
          • Executes dropped EXE
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:296
          • C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe
            "C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe" /i:296
            5⤵
              PID:1668

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\tzKzFt08skl5\sQQOjOTB.exe

      Filesize

      356KB

      MD5

      2ce0b699274fd451c88db973d0b0b4c0

      SHA1

      3eb737c06d201d63387ed17b8dafacb180594be1

      SHA256

      e780c7aee84831c2042fb957cf9a6ba3bb76e4c9f4cbb6ebe2966097ac89c054

      SHA512

      ed89351562a1104999d8beb1823c8e8395f4cb818490dca85f50e51336a87788328eae28bc5643d9ab3c7ff69f404b45e2d7ae38dac0eea7d13f7e66200952ec

    • C:\ProgramData\tzKzFt08skl5\sQQOjOTB.exe

      Filesize

      356KB

      MD5

      2ce0b699274fd451c88db973d0b0b4c0

      SHA1

      3eb737c06d201d63387ed17b8dafacb180594be1

      SHA256

      e780c7aee84831c2042fb957cf9a6ba3bb76e4c9f4cbb6ebe2966097ac89c054

      SHA512

      ed89351562a1104999d8beb1823c8e8395f4cb818490dca85f50e51336a87788328eae28bc5643d9ab3c7ff69f404b45e2d7ae38dac0eea7d13f7e66200952ec

    • C:\ProgramData\tzKzFt08skl5\sQQOjOTB.exe

      Filesize

      356KB

      MD5

      2ce0b699274fd451c88db973d0b0b4c0

      SHA1

      3eb737c06d201d63387ed17b8dafacb180594be1

      SHA256

      e780c7aee84831c2042fb957cf9a6ba3bb76e4c9f4cbb6ebe2966097ac89c054

      SHA512

      ed89351562a1104999d8beb1823c8e8395f4cb818490dca85f50e51336a87788328eae28bc5643d9ab3c7ff69f404b45e2d7ae38dac0eea7d13f7e66200952ec

    • \ProgramData\tzKzFt08skl5\sQQOjOTB.exe

      Filesize

      356KB

      MD5

      2ce0b699274fd451c88db973d0b0b4c0

      SHA1

      3eb737c06d201d63387ed17b8dafacb180594be1

      SHA256

      e780c7aee84831c2042fb957cf9a6ba3bb76e4c9f4cbb6ebe2966097ac89c054

      SHA512

      ed89351562a1104999d8beb1823c8e8395f4cb818490dca85f50e51336a87788328eae28bc5643d9ab3c7ff69f404b45e2d7ae38dac0eea7d13f7e66200952ec

    • \ProgramData\tzKzFt08skl5\sQQOjOTB.exe

      Filesize

      356KB

      MD5

      2ce0b699274fd451c88db973d0b0b4c0

      SHA1

      3eb737c06d201d63387ed17b8dafacb180594be1

      SHA256

      e780c7aee84831c2042fb957cf9a6ba3bb76e4c9f4cbb6ebe2966097ac89c054

      SHA512

      ed89351562a1104999d8beb1823c8e8395f4cb818490dca85f50e51336a87788328eae28bc5643d9ab3c7ff69f404b45e2d7ae38dac0eea7d13f7e66200952ec

    • \ProgramData\tzKzFt08skl5\sQQOjOTB.exe

      Filesize

      356KB

      MD5

      16992477af6c1128ccf8e2bb7d41b165

      SHA1

      f0a8f7bc308ee177dd83df0f573a2ea6654be847

      SHA256

      e9fdbdfd601f207f79d1eec6b55705b36ab482eac832f9f4ebf07a7878710a36

      SHA512

      9cb37d03753d1ccdaaf9952d64b1d6ec671e86d509e77e48137d13ea4afad452c7a413e7fc1d9231da253198e7d7d5756c702ebe176be9d7de276ba946a42117

    • \Users\Admin\AppData\Local\Temp\9CtplJZ2B.exe

      Filesize

      356KB

      MD5

      2ce0b699274fd451c88db973d0b0b4c0

      SHA1

      3eb737c06d201d63387ed17b8dafacb180594be1

      SHA256

      e780c7aee84831c2042fb957cf9a6ba3bb76e4c9f4cbb6ebe2966097ac89c054

      SHA512

      ed89351562a1104999d8beb1823c8e8395f4cb818490dca85f50e51336a87788328eae28bc5643d9ab3c7ff69f404b45e2d7ae38dac0eea7d13f7e66200952ec

    • memory/296-83-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/296-76-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/752-60-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/752-65-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/752-54-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/752-59-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/752-58-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/752-56-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1668-84-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1668-85-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB