Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    21s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 18:18

General

  • Target

    dacc93e154f1983e6af2d99d53afa46960115aa2af6b111b088618e1e46eac2b.exe

  • Size

    716KB

  • MD5

    cda11f190c3a11b2c9921b282773e558

  • SHA1

    50bef9a1e59965be2b537e62102496e3856700da

  • SHA256

    dacc93e154f1983e6af2d99d53afa46960115aa2af6b111b088618e1e46eac2b

  • SHA512

    ff6de93385f52165567c79ed3f9123659825b4651d81e329b8f3407413d1f07a99f5729023309d80ac0d3b4c8c986aa2d5a2840c7ab838652f5632146f49f66e

  • SSDEEP

    12288:B+HrtNnvW408cIL5XjTbF9w2EGZKRKRIGPZjLW0PuezYtXrgnSGCiavTnFxDvcMz:BMr7tsIxnbFfBRIaNL9PuezYt7QpCiaT

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dacc93e154f1983e6af2d99d53afa46960115aa2af6b111b088618e1e46eac2b.exe
    "C:\Users\Admin\AppData\Local\Temp\dacc93e154f1983e6af2d99d53afa46960115aa2af6b111b088618e1e46eac2b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\calavera.dll

    Filesize

    1.3MB

    MD5

    e45494ddae9b7eae720082b305795a94

    SHA1

    85ad31313d33b357254fcd180116e12b1e26cd85

    SHA256

    86ccc12f870ba1a75dba78014fc9eafc5de669852ca503587d02070484cb56c0

    SHA512

    1946c6ae3eacc3ccac3e868692bc222559961187b4bed1112e56dc61f5202e8f54a9b4d22a2d8fcd4cc0ddbb9cbe6eb030f14589bc7f2286f973611276f46901

  • memory/688-56-0x0000000000020000-0x0000000000023000-memory.dmp

    Filesize

    12KB

  • memory/688-55-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/688-59-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB