Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 13:38

General

  • Target

    f47cf14433e06c94973c4e3ca02ddd69ab20d5fa7003d2433b64de89a7829fe7.exe

  • Size

    293KB

  • MD5

    0e1592c7b8781c0aa67f8938e73d4e36

  • SHA1

    39cb50e283e32e1dfa137a7be55a5d7765c0865e

  • SHA256

    f47cf14433e06c94973c4e3ca02ddd69ab20d5fa7003d2433b64de89a7829fe7

  • SHA512

    629c42d8bb53566968125f458a9e09043a6bab2ff704ee229b34e4826ba4cba5339ceceb014f8bb28589a685b7c123b5db56fedb2c9c2c883174f7276134b29b

  • SSDEEP

    6144:PrkH9uEo2S1YnQmCX492DkwNP3qpYFkSJEw8NFPbNeIfV+iqhwpCIoDpw5:Prkdu6/eIo4/PPbNNfV+iUwpCPO

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f47cf14433e06c94973c4e3ca02ddd69ab20d5fa7003d2433b64de89a7829fe7.exe
    "C:\Users\Admin\AppData\Local\Temp\f47cf14433e06c94973c4e3ca02ddd69ab20d5fa7003d2433b64de89a7829fe7.exe"
    1⤵
    • Loads dropped DLL
    PID:1716

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu65FD2E9A.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{A15A374F-D473-4194-A37F-9C517AB915B9}\Custom.dll

    Filesize

    66KB

    MD5

    da2373d58c5519642847863bb056d862

    SHA1

    6cf6e5b5757dec9763317a3e1c5326408c96ce86

    SHA256

    87d0622e84a8ef4777ff36e3804487e9aef738d4a91601d2a6608d59c91f9e3c

    SHA512

    f06f2931b7129bfbd813858c5ed02932de8388ee497cae97deab674739eb81ebde278c8f373780eed1cef9723b60747501ebb966d40e9b40c864b206490956b0

  • \Users\Admin\AppData\Local\Temp\{A15A374F-D473-4194-A37F-9C517AB915B9}\_Setup.dll

    Filesize

    160KB

    MD5

    3d99f53c75ee301fd7bc5abe8d883dbb

    SHA1

    35264d2ed3c675f152ac54045ce817693234fe06

    SHA256

    4ba7a5ffcfa4409eca57e201bedf9357d59a28bfd08b23081eb48f93ed8abea0

    SHA512

    a58054619c56b4dc1653876050a0b67df9bcffcf078b62f8cd88b96511a370e3ae9c67effc36d0b152eb5429f60eba52e5e58afca85a58527a3bf3600a89a42f

  • memory/1716-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

    Filesize

    8KB