Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

c415dfa339...27.exe

windows7-x64

8

c415dfa339...27.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    138s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 00:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c415dfa339ff10b698d50c4ba6b47285f95e035172b2571b6ed49a80ea26a227.exe

  • Size

    135KB

  • MD5

    42571f9f491ba1d03df21c7e43736efa

  • SHA1

    c1e804e94f6863fc68b4e7b8f360226d8ae7869b

  • SHA256

    c415dfa339ff10b698d50c4ba6b47285f95e035172b2571b6ed49a80ea26a227

  • SHA512

    f4ec4acdc24558a33a340220acbda17c501365cfdbbd940702914debb1af8397573438f6677fe228316b43efb3efb237e1c4acbd6e9ae03ab988332e612ac39c

  • SSDEEP

    3072:rIxWnURa1S+RPn4L4ynf+upZrRWNY2lh8wrbout:rIgUKRP8mup5RWgwrboS

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c415dfa339ff10b698d50c4ba6b47285f95e035172b2571b6ed49a80ea26a227.exe
    "C:\Users\Admin\AppData\Local\Temp\c415dfa339ff10b698d50c4ba6b47285f95e035172b2571b6ed49a80ea26a227.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Windows\SysWOW64\msprxysvc32.exe
      C:\Windows\system32\msprxysvc32.exe 1152 "C:\Users\Admin\AppData\Local\Temp\c415dfa339ff10b698d50c4ba6b47285f95e035172b2571b6ed49a80ea26a227.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat C:\Windows\SysWOW64\msprxysvc32.exe
        3⤵
          PID:620

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\del.bat
      Filesize

      136B

      MD5

      bfcf9cc6d1c37953dfa43312e2c36140

      SHA1

      07a4c0f29b282c34be24c312c4b920e479f4cee0

      SHA256

      bac7cce52aeba3a2e2ce2bb6aebf50ffa65530d0d51ca49a2abc7f4e43ce3ce5

      SHA512

      fb661474557e7168d4050607863b57649fa12a26ab9bd06078ae3254d003d76cfed4eac3d0a78a56eaf0ecc5b231d52788b6c8688cb14b0c86a37efe90f5f53a

      Download Submit

    • C:\Windows\SysWOW64\msprxysvc32.exe
      Filesize

      135KB

      MD5

      42571f9f491ba1d03df21c7e43736efa

      SHA1

      c1e804e94f6863fc68b4e7b8f360226d8ae7869b

      SHA256

      c415dfa339ff10b698d50c4ba6b47285f95e035172b2571b6ed49a80ea26a227

      SHA512

      f4ec4acdc24558a33a340220acbda17c501365cfdbbd940702914debb1af8397573438f6677fe228316b43efb3efb237e1c4acbd6e9ae03ab988332e612ac39c

      Download Submit

    • C:\Windows\SysWOW64\msprxysvc32.exe
      Filesize

      135KB

      MD5

      42571f9f491ba1d03df21c7e43736efa

      SHA1

      c1e804e94f6863fc68b4e7b8f360226d8ae7869b

      SHA256

      c415dfa339ff10b698d50c4ba6b47285f95e035172b2571b6ed49a80ea26a227

      SHA512

      f4ec4acdc24558a33a340220acbda17c501365cfdbbd940702914debb1af8397573438f6677fe228316b43efb3efb237e1c4acbd6e9ae03ab988332e612ac39c

      Download Submit

    • memory/2132-137-0x0000000000400000-0x000000000049F000-memory.dmp

      Filesize

      636KB

      Download

    • memory/2132-139-0x0000000000400000-0x000000000049F000-memory.dmp

      Filesize

      636KB

      Download

    • memory/4676-132-0x0000000000400000-0x000000000049F000-memory.dmp

      Filesize

      636KB

      Download

    • memory/4676-136-0x0000000000400000-0x000000000049F000-memory.dmp

      Filesize

      636KB

      Download