Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    60s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 07:11

General

  • Target

    b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe

  • Size

    267KB

  • MD5

    295e0a20d9baa8f6565d293a7637f670

  • SHA1

    273587911419d798d9d7f16f759c59f69f0972ca

  • SHA256

    b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174

  • SHA512

    1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8

  • SSDEEP

    6144:KxZasmAMSle58AP7tmUk09zspjQi6i8xgWzDyQh+f+MmnQ:KBmAMjtPwUVpksvqWzONm

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
    "C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
      "C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1384
      • C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe
        "C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe
          "C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"
          4⤵
          • Executes dropped EXE
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1124
          • C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe" /i:1124
            5⤵
              PID:1668

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

      Filesize

      267KB

      MD5

      d73b562268e1342ad98d32c7d208859f

      SHA1

      47028d6273745af323b35930976ddb58c6b79c21

      SHA256

      0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

      SHA512

      28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

    • C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

      Filesize

      267KB

      MD5

      d73b562268e1342ad98d32c7d208859f

      SHA1

      47028d6273745af323b35930976ddb58c6b79c21

      SHA256

      0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

      SHA512

      28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

    • C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

      Filesize

      267KB

      MD5

      d73b562268e1342ad98d32c7d208859f

      SHA1

      47028d6273745af323b35930976ddb58c6b79c21

      SHA256

      0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

      SHA512

      28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

    • \ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

      Filesize

      267KB

      MD5

      d73b562268e1342ad98d32c7d208859f

      SHA1

      47028d6273745af323b35930976ddb58c6b79c21

      SHA256

      0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

      SHA512

      28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

    • \ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

      Filesize

      267KB

      MD5

      d73b562268e1342ad98d32c7d208859f

      SHA1

      47028d6273745af323b35930976ddb58c6b79c21

      SHA256

      0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

      SHA512

      28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

    • \ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe

      Filesize

      267KB

      MD5

      295e0a20d9baa8f6565d293a7637f670

      SHA1

      273587911419d798d9d7f16f759c59f69f0972ca

      SHA256

      b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174

      SHA512

      1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8

    • \Users\Admin\AppData\Local\Temp\01zRWddLRV.exe

      Filesize

      267KB

      MD5

      d73b562268e1342ad98d32c7d208859f

      SHA1

      47028d6273745af323b35930976ddb58c6b79c21

      SHA256

      0047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776

      SHA512

      28755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0

    • memory/1124-75-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1124-84-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1124-77-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1384-54-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1384-58-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1384-61-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1384-56-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1384-59-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1384-66-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1668-85-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1668-86-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB