Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    25s
  • max time network
    60s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 15:08

General

  • Target

    ad6d2298cc31d44fff8cb5daa2b46bda48629d4cc38b953094f48bc3263aef82.exe

  • Size

    293KB

  • MD5

    8541f058bab100bf38307c87e4fea61c

  • SHA1

    f54b0ffb1b3d9fb821f3f40aa96de18c82237da4

  • SHA256

    ad6d2298cc31d44fff8cb5daa2b46bda48629d4cc38b953094f48bc3263aef82

  • SHA512

    83cfebdf4a811f2bc4381a659ce5dd87d892160fa7c0005f20e1275220bb3c96c5ac575278d4f5d01af716cb49d5d70b42ccb773a9177d15e9d18bd5c7461b86

  • SSDEEP

    6144:grk29uEo2S1YnQmCX492DkwNP3qpYF2hVIPo+BjmKUyQgSTHCG8Dr9AJb:grkOu6/eIo4kT6FycHCGKAh

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad6d2298cc31d44fff8cb5daa2b46bda48629d4cc38b953094f48bc3263aef82.exe
    "C:\Users\Admin\AppData\Local\Temp\ad6d2298cc31d44fff8cb5daa2b46bda48629d4cc38b953094f48bc3263aef82.exe"
    1⤵
    • Loads dropped DLL
    PID:1452

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu3FE5C4B6.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{A4C12C5D-84D1-44A7-A64C-CCF37F220EAB}\Custom.dll

    Filesize

    66KB

    MD5

    d53cae5f680dd2ed181af7d33d8cc8b6

    SHA1

    c1de9522515ae41b299689eba12fa09192c4a3c5

    SHA256

    39856115698ed45b91184f18c1343d370ed1a214b008dc13d5a132f8b461e9b7

    SHA512

    c04306f033f50da600cd446505557aba870a11e979d5aae214361360b5043d7df9d0b3b1da0fe3ac45cec006aec52ff3bbe6c0d08ca8090294d2c369a75c97ce

  • \Users\Admin\AppData\Local\Temp\{A4C12C5D-84D1-44A7-A64C-CCF37F220EAB}\_Setup.dll

    Filesize

    160KB

    MD5

    3d99f53c75ee301fd7bc5abe8d883dbb

    SHA1

    35264d2ed3c675f152ac54045ce817693234fe06

    SHA256

    4ba7a5ffcfa4409eca57e201bedf9357d59a28bfd08b23081eb48f93ed8abea0

    SHA512

    a58054619c56b4dc1653876050a0b67df9bcffcf078b62f8cd88b96511a370e3ae9c67effc36d0b152eb5429f60eba52e5e58afca85a58527a3bf3600a89a42f

  • memory/1452-55-0x0000000076181000-0x0000000076183000-memory.dmp

    Filesize

    8KB