Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    259s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/07/2023, 03:38

General

  • Target

    7526a108e24d1f7479bd33864057b806e0bc63f0f55fb234263f7a8ea751a6a6.exe

  • Size

    1.7MB

  • MD5

    07566dc1e1cd7a75b11f8cefa85245cb

  • SHA1

    ad9f60d6b923f3d492deae644ab7ea838bebc97d

  • SHA256

    7526a108e24d1f7479bd33864057b806e0bc63f0f55fb234263f7a8ea751a6a6

  • SHA512

    fb46ca2175f18301ded5e1cbe720fc147503bc079dfa69cb091417c2a20a09d2203c059f73164a496b3dd8a9b99f5e9be4866e485098bedc5fae11bc368613be

  • SSDEEP

    24576:PgZXoZUTVdt7K7UbPLJTRaF76SB1MUewOBeuiCeeMZFvW5lekw7VHIlSr3AKjz30:u5O6SwQDCeeMf2lrsr3AKjz3Fyo2L

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7526a108e24d1f7479bd33864057b806e0bc63f0f55fb234263f7a8ea751a6a6.exe
    "C:\Users\Admin\AppData\Local\Temp\7526a108e24d1f7479bd33864057b806e0bc63f0f55fb234263f7a8ea751a6a6.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\27BC_bF.cpl",
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\27BC_bF.cpl",
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Windows\system32\RunDll32.exe
          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\27BC_bF.cpl",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:752
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\27BC_bF.cpl",
            5⤵
            • Loads dropped DLL
            PID:4160

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\27BC_bF.cpl

    Filesize

    1.3MB

    MD5

    9649c9b7fc5e4df4152c258c95acbd0d

    SHA1

    d57b276c577d86268ea672a8d084a24c5ba33a99

    SHA256

    8b6ddd483fd4e6dd2347d70c4059a611709241be03e12773bfe13f3c2e7f6aad

    SHA512

    f937971b39f89a471f8c15dce68d1bf92771061e0db18ba3bfebec0891e72290975a5507c95e446ec0a62bb1ec45a727fbf335c887913c35df454832629319f7

  • \Users\Admin\AppData\Local\Temp\27BC_bF.cpl

    Filesize

    1.3MB

    MD5

    9649c9b7fc5e4df4152c258c95acbd0d

    SHA1

    d57b276c577d86268ea672a8d084a24c5ba33a99

    SHA256

    8b6ddd483fd4e6dd2347d70c4059a611709241be03e12773bfe13f3c2e7f6aad

    SHA512

    f937971b39f89a471f8c15dce68d1bf92771061e0db18ba3bfebec0891e72290975a5507c95e446ec0a62bb1ec45a727fbf335c887913c35df454832629319f7

  • \Users\Admin\AppData\Local\Temp\27BC_bF.cpl

    Filesize

    1.3MB

    MD5

    9649c9b7fc5e4df4152c258c95acbd0d

    SHA1

    d57b276c577d86268ea672a8d084a24c5ba33a99

    SHA256

    8b6ddd483fd4e6dd2347d70c4059a611709241be03e12773bfe13f3c2e7f6aad

    SHA512

    f937971b39f89a471f8c15dce68d1bf92771061e0db18ba3bfebec0891e72290975a5507c95e446ec0a62bb1ec45a727fbf335c887913c35df454832629319f7

  • memory/4160-151-0x0000000005020000-0x000000000510E000-memory.dmp

    Filesize

    952KB

  • memory/4160-150-0x0000000005020000-0x000000000510E000-memory.dmp

    Filesize

    952KB

  • memory/4160-147-0x0000000005020000-0x000000000510E000-memory.dmp

    Filesize

    952KB

  • memory/4160-146-0x0000000004F10000-0x0000000005016000-memory.dmp

    Filesize

    1.0MB

  • memory/4160-143-0x0000000002EF0000-0x0000000002EF6000-memory.dmp

    Filesize

    24KB

  • memory/4528-131-0x0000000003470000-0x0000000003476000-memory.dmp

    Filesize

    24KB

  • memory/4528-139-0x0000000004E00000-0x0000000004EEE000-memory.dmp

    Filesize

    952KB

  • memory/4528-138-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB

  • memory/4528-137-0x0000000004E00000-0x0000000004EEE000-memory.dmp

    Filesize

    952KB

  • memory/4528-134-0x0000000004E00000-0x0000000004EEE000-memory.dmp

    Filesize

    952KB

  • memory/4528-133-0x0000000005520000-0x0000000005626000-memory.dmp

    Filesize

    1.0MB

  • memory/4528-129-0x0000000000400000-0x0000000000543000-memory.dmp

    Filesize

    1.3MB