Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/02/2023, 20:56

General

  • Target

    audiorelay-0.26.3.exe

  • Size

    67.0MB

  • MD5

    38d740dec76b5e54be34a9525b480f07

  • SHA1

    9409ac288cbacece7a67a0eec279041fbb0d3224

  • SHA256

    660a6eae9e54c171ae0af8715a139dca208d681ab8387e1bbb549f32a272db85

  • SHA512

    396c933cd8eebd8d976125285353e504d8b746098f98ff3dbf101be5297dfea0eb9a67b5dba67a93c7419d4d7d8d458c646930e3862b16fa06680a87daaab70e

  • SSDEEP

    1572864:yE29MvoOZ/g1ncgWqG7jhMPLO5pMtl+6JooujuppK:yQ1g1RSFcApM3a4K

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\audiorelay-0.26.3.exe
    "C:\Users\Admin\AppData\Local\Temp\audiorelay-0.26.3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Users\Admin\AppData\Local\Temp\is-QK576.tmp\audiorelay-0.26.3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QK576.tmp\audiorelay-0.26.3.tmp" /SL5="$7012C,69350757,807936,C:\Users\Admin\AppData\Local\Temp\audiorelay-0.26.3.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-QK576.tmp\audiorelay-0.26.3.tmp

    Filesize

    3.0MB

    MD5

    d23c4889083bffb5745018940106188f

    SHA1

    5db1ec5c44338ef81bc19a62fd30b28ee9e878c7

    SHA256

    744b1df190de846db4a043489475ab70c914d53bb9697ee27e6769e72912accd

    SHA512

    c468a9aa4085cb0458171d4c8cca46aad0e5bd49fb87f9b88ceeaf1c1997d1f654d9b3f1e4a6eab8240e3f1319059ef9f0cba03184e00f1119d1dfa205709743

  • \Users\Admin\AppData\Local\Temp\is-QK576.tmp\audiorelay-0.26.3.tmp

    Filesize

    3.0MB

    MD5

    d23c4889083bffb5745018940106188f

    SHA1

    5db1ec5c44338ef81bc19a62fd30b28ee9e878c7

    SHA256

    744b1df190de846db4a043489475ab70c914d53bb9697ee27e6769e72912accd

    SHA512

    c468a9aa4085cb0458171d4c8cca46aad0e5bd49fb87f9b88ceeaf1c1997d1f654d9b3f1e4a6eab8240e3f1319059ef9f0cba03184e00f1119d1dfa205709743

  • memory/828-54-0x0000000075C41000-0x0000000075C43000-memory.dmp

    Filesize

    8KB

  • memory/828-55-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/828-59-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

  • memory/828-62-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB