Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    192s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 20:13

General

  • Target

    03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe

  • Size

    479KB

  • MD5

    973bb318f1df1f635491077188ac5e4b

  • SHA1

    3e59a536851d015cf186b5e756a8ee60d0aa9bfc

  • SHA256

    03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd

  • SHA512

    c57bf5fce21e3866f0bbec8d1e86755c277c989ecbeb80eb124ec86eed5b228c94835ccd6e1d188537e90375d83f120965e1c4487c7a8b68f3eb838f32fc4f35

  • SSDEEP

    12288:bMrjty90OZ13IXn7rWGsdLfBMdd/uST1a7Cfx:0tyTU7rWGmLSdwSxR5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe
    "C:\Users\Admin\AppData\Local\Temp\03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1680

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exe

    Filesize

    307KB

    MD5

    a150e3b563bc4a94f4cfb60b454cfd75

    SHA1

    e7252f55fefdcf87eb9dddef0fd404946c59d198

    SHA256

    b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa

    SHA512

    bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exe

    Filesize

    307KB

    MD5

    a150e3b563bc4a94f4cfb60b454cfd75

    SHA1

    e7252f55fefdcf87eb9dddef0fd404946c59d198

    SHA256

    b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa

    SHA512

    bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exe

    Filesize

    137KB

    MD5

    23de4b48a1351aa2ae1efeaadd269604

    SHA1

    9523df2ef8b2c651d8f6f995734f970edc188746

    SHA256

    dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0

    SHA512

    a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exe

    Filesize

    137KB

    MD5

    23de4b48a1351aa2ae1efeaadd269604

    SHA1

    9523df2ef8b2c651d8f6f995734f970edc188746

    SHA256

    dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0

    SHA512

    a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exe

    Filesize

    307KB

    MD5

    a150e3b563bc4a94f4cfb60b454cfd75

    SHA1

    e7252f55fefdcf87eb9dddef0fd404946c59d198

    SHA256

    b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa

    SHA512

    bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exe

    Filesize

    307KB

    MD5

    a150e3b563bc4a94f4cfb60b454cfd75

    SHA1

    e7252f55fefdcf87eb9dddef0fd404946c59d198

    SHA256

    b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa

    SHA512

    bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exe

    Filesize

    137KB

    MD5

    23de4b48a1351aa2ae1efeaadd269604

    SHA1

    9523df2ef8b2c651d8f6f995734f970edc188746

    SHA256

    dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0

    SHA512

    a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exe

    Filesize

    137KB

    MD5

    23de4b48a1351aa2ae1efeaadd269604

    SHA1

    9523df2ef8b2c651d8f6f995734f970edc188746

    SHA256

    dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0

    SHA512

    a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd

  • memory/1680-74-0x0000000000A00000-0x0000000000A28000-memory.dmp

    Filesize

    160KB

  • memory/1680-75-0x00000000071F0000-0x0000000007230000-memory.dmp

    Filesize

    256KB

  • memory/1680-76-0x00000000071F0000-0x0000000007230000-memory.dmp

    Filesize

    256KB