Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    25s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02/12/2022, 17:36

General

  • Target

    b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe

  • Size

    404KB

  • MD5

    6fc529de07d137f3ee1ba04f5ff6e5c4

  • SHA1

    4e6884206ce49342ebef7d03dd81dd6dbed7a60f

  • SHA256

    b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760

  • SHA512

    c725d789f0d50333ec620b2ebfb52261b12cf1d7d3724b67d506c6aeca698777b7e535bb9fe541aa3627e1a7272cd2e028db53fc3c8f69a41bf2bb2d73934ca8

  • SSDEEP

    12288:35Bevhp0wpE9z/uXagSAiLNZQ4i696+IUvbOI2/Kmu7wxwj:gWqJSzZOCIiiymuf

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 12 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
    "C:\Users\Admin\AppData\Local\Temp\b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Windows\MBR Regenerator\engine.cmd""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1784
      • C:\Windows\SysWOW64\mode.com
        mode con: cols=80 lines=16
        3⤵
          PID:768
        • C:\Windows\SysWOW64\reg.exe
          REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
          3⤵
            PID:672
          • C:\Windows\SysWOW64\findstr.exe
            FINDSTR "7"
            3⤵
              PID:1164
            • C:\Windows\SysWOW64\reg.exe
              REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
              3⤵
                PID:1920
              • C:\Windows\SysWOW64\find.exe
                find /i "Ultimate"
                3⤵
                  PID:588

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\MBR Regenerator\engine.cmd

              Filesize

              16KB

              MD5

              9807689728c81d44376164beaed5498f

              SHA1

              94052d250b3d6dba4cd002b04fa8c933353a429a

              SHA256

              c2e381524ea02e1a447c0f091da8d695ba5be58c707f09486080a282bceaeb05

              SHA512

              ab71c1686d858e80eec4d04d220b140dce08c14f811bdd034eaf77bf616202341356b127c65777a85af629633108b98c5aeddb94c70fc6a2342bc4b5d49ced09

            • memory/1956-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

              Filesize

              8KB

            • memory/1956-56-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB