Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 08:05

General

  • Target

    b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883.exe

  • Size

    23KB

  • MD5

    7193b531605532242806a6a37fdc4b58

  • SHA1

    fa64fbf72c4a9c5190edcdefc346dbc829fee7ef

  • SHA256

    b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883

  • SHA512

    4a311c7b1a3d1be240283262a65767e9be853a09c08302363ce2eb8c3c17f7c77b602ea2653ffcf9de9b30833704431bd5035cfe979ed9979bf36a8441c5c1ad

  • SSDEEP

    384:CLJ0kGOFOGFtfFVk/wQPpwsjvt1RP+/R8HWhsRf3oyMsB5g:CNbfUYQPzjvt1ZWhsRASg

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883.exe
    "C:\Users\Admin\AppData\Local\Temp\b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c copy "C:\Users\Admin\AppData\Local\Temp\b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
        PID:1364
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          C:\Users\Admin\AppData\Local\Temp\svchost.exe
          3⤵
          • Modifies WinLogon for persistence
          • Modifies firewall policy service
          • Executes dropped EXE
          PID:1600

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      23KB

      MD5

      7193b531605532242806a6a37fdc4b58

      SHA1

      fa64fbf72c4a9c5190edcdefc346dbc829fee7ef

      SHA256

      b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883

      SHA512

      4a311c7b1a3d1be240283262a65767e9be853a09c08302363ce2eb8c3c17f7c77b602ea2653ffcf9de9b30833704431bd5035cfe979ed9979bf36a8441c5c1ad

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      23KB

      MD5

      7193b531605532242806a6a37fdc4b58

      SHA1

      fa64fbf72c4a9c5190edcdefc346dbc829fee7ef

      SHA256

      b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883

      SHA512

      4a311c7b1a3d1be240283262a65767e9be853a09c08302363ce2eb8c3c17f7c77b602ea2653ffcf9de9b30833704431bd5035cfe979ed9979bf36a8441c5c1ad

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      23KB

      MD5

      7193b531605532242806a6a37fdc4b58

      SHA1

      fa64fbf72c4a9c5190edcdefc346dbc829fee7ef

      SHA256

      b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883

      SHA512

      4a311c7b1a3d1be240283262a65767e9be853a09c08302363ce2eb8c3c17f7c77b602ea2653ffcf9de9b30833704431bd5035cfe979ed9979bf36a8441c5c1ad

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      23KB

      MD5

      7193b531605532242806a6a37fdc4b58

      SHA1

      fa64fbf72c4a9c5190edcdefc346dbc829fee7ef

      SHA256

      b4c06bb81f97cf90a2097a587ecdc950689fa89ef6f223134712d02f15f66883

      SHA512

      4a311c7b1a3d1be240283262a65767e9be853a09c08302363ce2eb8c3c17f7c77b602ea2653ffcf9de9b30833704431bd5035cfe979ed9979bf36a8441c5c1ad

    • memory/1080-63-0x00000000001B0000-0x00000000001C0000-memory.dmp

      Filesize

      64KB

    • memory/1080-64-0x00000000001B0000-0x00000000001C0000-memory.dmp

      Filesize

      64KB

    • memory/1080-67-0x00000000001B0000-0x00000000001C0000-memory.dmp

      Filesize

      64KB

    • memory/1356-54-0x0000000075091000-0x0000000075093000-memory.dmp

      Filesize

      8KB

    • memory/1356-57-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/1600-65-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/1600-68-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB