Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    53s
  • max time network
    64s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/05/2023, 14:00

General

  • Target

    70ba9805865b11cfd76dc88154aa4482aff5c506ba9cf44cacda6fe29c639e06.exe

  • Size

    7.1MB

  • MD5

    5cb3d3eafd5a549b39121299237b2f37

  • SHA1

    00ec08735f713cd17e1b3beaa2da4237fc501608

  • SHA256

    70ba9805865b11cfd76dc88154aa4482aff5c506ba9cf44cacda6fe29c639e06

  • SHA512

    d567472262742dc513fcdfd4be732518e982403a58fde35e94b825e3e0b1cc56ab0ae1fb3bd1cd68d2a7e013930b367109d869fbb33d3c7bc9ac76b382f7f3dd

  • SSDEEP

    98304:hcNTmZRC9TTqMW6EuPe54Ht38nNJv0h2BaNmoChLRJZravX:hcNkk93J9P0At3McoaY3VyvX

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70ba9805865b11cfd76dc88154aa4482aff5c506ba9cf44cacda6fe29c639e06.exe
    "C:\Users\Admin\AppData\Local\Temp\70ba9805865b11cfd76dc88154aa4482aff5c506ba9cf44cacda6fe29c639e06.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\ProgramData\DesktopOracle-1II6.8.5.4\DesktopOracle-1II6.8.5.4.exe
      C:\ProgramData\DesktopOracle-1II6.8.5.4\DesktopOracle-1II6.8.5.4.exe
      2⤵
      • Executes dropped EXE
      PID:4088

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\DesktopOracle-1II6.8.5.4\DesktopOracle-1II6.8.5.4.exe

    Filesize

    7.1MB

    MD5

    5cb3d3eafd5a549b39121299237b2f37

    SHA1

    00ec08735f713cd17e1b3beaa2da4237fc501608

    SHA256

    70ba9805865b11cfd76dc88154aa4482aff5c506ba9cf44cacda6fe29c639e06

    SHA512

    d567472262742dc513fcdfd4be732518e982403a58fde35e94b825e3e0b1cc56ab0ae1fb3bd1cd68d2a7e013930b367109d869fbb33d3c7bc9ac76b382f7f3dd

  • C:\ProgramData\DesktopOracle-1II6.8.5.4\DesktopOracle-1II6.8.5.4.exe

    Filesize

    7.1MB

    MD5

    5cb3d3eafd5a549b39121299237b2f37

    SHA1

    00ec08735f713cd17e1b3beaa2da4237fc501608

    SHA256

    70ba9805865b11cfd76dc88154aa4482aff5c506ba9cf44cacda6fe29c639e06

    SHA512

    d567472262742dc513fcdfd4be732518e982403a58fde35e94b825e3e0b1cc56ab0ae1fb3bd1cd68d2a7e013930b367109d869fbb33d3c7bc9ac76b382f7f3dd

  • memory/4088-125-0x00007FF797550000-0x00007FF797C70000-memory.dmp

    Filesize

    7.1MB

  • memory/4300-120-0x00007FF7236D0000-0x00007FF723DF0000-memory.dmp

    Filesize

    7.1MB