Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19/05/2023, 02:09

General

  • Target

    091_herpa_AJ.exe

  • Size

    165KB

  • MD5

    99e9010f29db663dc40e8304732c28d7

  • SHA1

    531177055c87d7098a8cbd9f8accfcab26a63619

  • SHA256

    0e2ca9e900856db54c1cea37cbd05754296113da1a80297f3cfe36fa642b760a

  • SHA512

    f77a7ae82108f064ddc63577e423e6420777c6722d8a506bf00d1236e8b6649cfc40cdcec1a292b4acdf6b9966c5a65a368952c282eb3a801526a1f3e2978ece

  • SSDEEP

    3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46Uolqech:ndr0I0c5XICuiNLnluOdohPolY

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\091_herpa_AJ.exe
    "C:\Users\Admin\AppData\Local\Temp\091_herpa_AJ.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1108
    • \Users\Admin\AppData\Local\Temp\nsvbixsibb.exe
      2⤵
      • Executes dropped EXE
      PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsvbixsibb.exe

    Filesize

    897KB

    MD5

    10e4a1d2132ccb5c6759f038cdb6f3c9

    SHA1

    42d36eeb2140441b48287b7cd30b38105986d68f

    SHA256

    c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b

    SHA512

    9bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d

  • memory/2028-55-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

    Filesize

    4KB

  • memory/2028-54-0x0000000000010000-0x0000000000012000-memory.dmp

    Filesize

    8KB

  • memory/2028-58-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB