Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 17:02

General

  • Target

    d5a15578c8d1873cf75ca532beac51897e6b2f580d628991edbb25a484d4c623.exe

  • Size

    60KB

  • MD5

    3c18fa459f1655dfc0fc566cbb084f9c

  • SHA1

    a45e28a22277ceb38bf1e91bee4a41b86acc8357

  • SHA256

    d5a15578c8d1873cf75ca532beac51897e6b2f580d628991edbb25a484d4c623

  • SHA512

    538a4b65c11d7894aaa3d5d12f8475a9cde06fb18539884f27dbb38395769473f05e3663bed9d7bb88b3c3c1750face0a80e5478cac7696f80df67670a93d367

  • SSDEEP

    768:7i/My0p89+zxEbjakT725yBFkQF3CXnf5+NODzu1QW1N41wMr9uygSCyslOgv07v:vzK9P3EA6cyXfBuyWcr9JgS2Ogs76ZQ

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1236
      • C:\Users\Admin\AppData\Local\Temp\d5a15578c8d1873cf75ca532beac51897e6b2f580d628991edbb25a484d4c623.exe
        "C:\Users\Admin\AppData\Local\Temp\d5a15578c8d1873cf75ca532beac51897e6b2f580d628991edbb25a484d4c623.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:564
        • C:\Users\Admin\AppData\Local\Temp\d5a15578c8d1873cf75ca532beac51897e6b2f580d628991edbb25a484d4c623.exe
          "C:\Users\Admin\AppData\Local\Temp\d5a15578c8d1873cf75ca532beac51897e6b2f580d628991edbb25a484d4c623.exe"
          3⤵
          • Drops startup file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1724

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/564-54-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/564-55-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/564-56-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

      Filesize

      8KB

    • memory/564-60-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/564-61-0x0000000001D90000-0x0000000001DA9000-memory.dmp

      Filesize

      100KB

    • memory/1236-63-0x0000000002130000-0x0000000002133000-memory.dmp

      Filesize

      12KB

    • memory/1724-57-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/1724-62-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

    • memory/1724-65-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB