Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    48s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 04:45

General

  • Target

    cc94cfdd942b4641a7b4da06bd0132458f10405faa38254a8632e443f9cd665e.exe

  • Size

    411KB

  • MD5

    08676b95280cafe13195a945df006200

  • SHA1

    5bfc816f813eeeb3f1416042b354f4ce7450ee9a

  • SHA256

    cc94cfdd942b4641a7b4da06bd0132458f10405faa38254a8632e443f9cd665e

  • SHA512

    8b6e659b79518a06d0f26a2c91d2487790c5a193a7681324e8f0236d89dc857addab9b21c6b4ba89307390fb46da53340226d9d8c2a590c598a2471d7f2f1ca1

  • SSDEEP

    6144:9GK72sKYVexS/b2biJi4SuQyIoDb15pzyLDKtg:9pAnS/b2GJi4qoLNyL2

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc94cfdd942b4641a7b4da06bd0132458f10405faa38254a8632e443f9cd665e.exe
    "C:\Users\Admin\AppData\Local\Temp\cc94cfdd942b4641a7b4da06bd0132458f10405faa38254a8632e443f9cd665e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\cc94cfdd942b4641a7b4da06bd0132458f10405faa38254a8632e443f9cd665e.exe
      "C:\Users\Admin\AppData\Local\Temp\cc94cfdd942b4641a7b4da06bd0132458f10405faa38254a8632e443f9cd665e.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1584
      • C:\ProgramData\p143da22\pYf7L7GLG.exe
        "C:\ProgramData\p143da22\pYf7L7GLG.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\ProgramData\p143da22\pYf7L7GLG.exe
          "C:\ProgramData\p143da22\pYf7L7GLG.exe"
          4⤵
          • Executes dropped EXE
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:280
          • C:\Program Files (x86)\Internet Explorer\ExtExport.exe
            "C:\Program Files (x86)\Internet Explorer\ExtExport.exe" /i:280
            5⤵
              PID:700

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\p143da22\pYf7L7GLG.exe

      Filesize

      411KB

      MD5

      97e576e71564e385445cf5c7677a7e61

      SHA1

      f9c2ca54af5a5df469fcf1b6dafa307ec049120d

      SHA256

      7ed631d4c9463b2e2d264dad10a53c8978e8fea0096b97727cc27ed66acdd65c

      SHA512

      bf7de282d76a2a4646ac4cbf3ba899c73f1d1d96a42513830a2c437ab8977828b0204c28c4161c25a9c61686be16f04792fe679f3004f818447c3e1de55261cf

    • C:\ProgramData\p143da22\pYf7L7GLG.exe

      Filesize

      411KB

      MD5

      97e576e71564e385445cf5c7677a7e61

      SHA1

      f9c2ca54af5a5df469fcf1b6dafa307ec049120d

      SHA256

      7ed631d4c9463b2e2d264dad10a53c8978e8fea0096b97727cc27ed66acdd65c

      SHA512

      bf7de282d76a2a4646ac4cbf3ba899c73f1d1d96a42513830a2c437ab8977828b0204c28c4161c25a9c61686be16f04792fe679f3004f818447c3e1de55261cf

    • C:\ProgramData\p143da22\pYf7L7GLG.exe

      Filesize

      411KB

      MD5

      97e576e71564e385445cf5c7677a7e61

      SHA1

      f9c2ca54af5a5df469fcf1b6dafa307ec049120d

      SHA256

      7ed631d4c9463b2e2d264dad10a53c8978e8fea0096b97727cc27ed66acdd65c

      SHA512

      bf7de282d76a2a4646ac4cbf3ba899c73f1d1d96a42513830a2c437ab8977828b0204c28c4161c25a9c61686be16f04792fe679f3004f818447c3e1de55261cf

    • \ProgramData\p143da22\pYf7L7GLG.exe

      Filesize

      411KB

      MD5

      97e576e71564e385445cf5c7677a7e61

      SHA1

      f9c2ca54af5a5df469fcf1b6dafa307ec049120d

      SHA256

      7ed631d4c9463b2e2d264dad10a53c8978e8fea0096b97727cc27ed66acdd65c

      SHA512

      bf7de282d76a2a4646ac4cbf3ba899c73f1d1d96a42513830a2c437ab8977828b0204c28c4161c25a9c61686be16f04792fe679f3004f818447c3e1de55261cf

    • \ProgramData\p143da22\pYf7L7GLG.exe

      Filesize

      411KB

      MD5

      97e576e71564e385445cf5c7677a7e61

      SHA1

      f9c2ca54af5a5df469fcf1b6dafa307ec049120d

      SHA256

      7ed631d4c9463b2e2d264dad10a53c8978e8fea0096b97727cc27ed66acdd65c

      SHA512

      bf7de282d76a2a4646ac4cbf3ba899c73f1d1d96a42513830a2c437ab8977828b0204c28c4161c25a9c61686be16f04792fe679f3004f818447c3e1de55261cf

    • \ProgramData\p143da22\pYf7L7GLG.exe

      Filesize

      411KB

      MD5

      08676b95280cafe13195a945df006200

      SHA1

      5bfc816f813eeeb3f1416042b354f4ce7450ee9a

      SHA256

      cc94cfdd942b4641a7b4da06bd0132458f10405faa38254a8632e443f9cd665e

      SHA512

      8b6e659b79518a06d0f26a2c91d2487790c5a193a7681324e8f0236d89dc857addab9b21c6b4ba89307390fb46da53340226d9d8c2a590c598a2471d7f2f1ca1

    • \Users\Admin\AppData\Local\Temp\QAlEXA3sKyqkj7KR.exe

      Filesize

      411KB

      MD5

      97e576e71564e385445cf5c7677a7e61

      SHA1

      f9c2ca54af5a5df469fcf1b6dafa307ec049120d

      SHA256

      7ed631d4c9463b2e2d264dad10a53c8978e8fea0096b97727cc27ed66acdd65c

      SHA512

      bf7de282d76a2a4646ac4cbf3ba899c73f1d1d96a42513830a2c437ab8977828b0204c28c4161c25a9c61686be16f04792fe679f3004f818447c3e1de55261cf

    • memory/280-82-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/280-74-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/700-83-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/700-84-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1584-56-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1584-65-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1584-58-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1584-54-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1584-59-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB