Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2023, 16:52

General

  • Target

    easyMalicious290f005eb89a.exe

  • Size

    583KB

  • MD5

    c5432a72571b96840cceb1a9f3632e44

  • SHA1

    00502b61a8221841057934d8df2d567fcae75112

  • SHA256

    f4c9450208b5fe805a5bda89af3308e17b512f693893c120b8eea617fd03f77f

  • SHA512

    e3bad37276be2762ee462a92b41c1e8ab114b8e2e40c2b383f2d765212436c93778269e5957d8731b45fefc9c036911e6916514cc64c4f63ece91406b0e8035d

  • SSDEEP

    12288:51bz5/JrM6qJyGt9GO0S0QSoFohsMdXZ0aOHvw1mC/9:51bz5Rr/uyQt0SW5dXtjl

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\easyMalicious290f005eb89a.exe
    "C:\Users\Admin\AppData\Local\Temp\easyMalicious290f005eb89a.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in System32 directory
    PID:1708

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\DC++ Share\idlj.exe

    Filesize

    76KB

    MD5

    8afb771e427e43a2159cab9729d05e85

    SHA1

    7c0bcc5fc7deec99f1be8ff83b7e64ec4bec244f

    SHA256

    173379c50b52da74e6e860f26e9f73012dbced09739d1b55c24306ea27f3a92c

    SHA512

    dc1ef915e7a3f7193224ec71ed11bcbcd62d1bf198a930fef83e313b2a40758216c5e71b280829a69dd460164a7b4889ae35443f4b9bca138013078bbcaf4092

  • C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

    Filesize

    631KB

    MD5

    b0c0f5e242dc2fa4bb8c6e5de5d4f47a

    SHA1

    6e819fabb7eee3d9e53bce642de4f37de8858078

    SHA256

    ef65e3f5e82b3e9907438e1a829aa7c01b815eb14f0177d31355f59f06022eee

    SHA512

    590de3177b7faf4b296cd5baec44aa77d3c46f86762a87ac66e5c0a385a8fb39b031af9b8cdac6c52498e5767a7894749bb35ca2dddcb362c0ee6990e67c72c2

  • memory/1708-247-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-248-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-243-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-244-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-245-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-246-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-154-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-176-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-249-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-250-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-251-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-252-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-253-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/1708-254-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB