Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230705-en
  • resource tags

    arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2023, 17:12

General

  • Target

    87598d9cc4bc46exeexeexeex.exe

  • Size

    56KB

  • MD5

    87598d9cc4bc46228fe863d40296382b

  • SHA1

    84f2de7adbd8d48073d4f3968aa1a899a3170388

  • SHA256

    2fc3008e382feea9f678636409b1ca9932cbc4e01260acb6541a12828ffec214

  • SHA512

    a927e920ce0244bea255a477be168c93be8c40f13c76a7bf0f179f2b786b265e8793a60240f15c627e9ae91e66a1924a237287285360f49e829cf6cc62493fa0

  • SSDEEP

    768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeo9e1jR4llT:ZzFbxmLPWQMOtEvwDpj38lD/cMAPm8lT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87598d9cc4bc46exeexeexeex.exe
    "C:\Users\Admin\AppData\Local\Temp\87598d9cc4bc46exeexeexeex.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    56KB

    MD5

    e0e3d8daa0f830b497492b4b022e28cb

    SHA1

    c459e7e6d291b0b31e35e6ae6bb828a85b3cf246

    SHA256

    c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d

    SHA512

    fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    56KB

    MD5

    e0e3d8daa0f830b497492b4b022e28cb

    SHA1

    c459e7e6d291b0b31e35e6ae6bb828a85b3cf246

    SHA256

    c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d

    SHA512

    fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    56KB

    MD5

    e0e3d8daa0f830b497492b4b022e28cb

    SHA1

    c459e7e6d291b0b31e35e6ae6bb828a85b3cf246

    SHA256

    c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d

    SHA512

    fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635

  • memory/2000-69-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2192-54-0x0000000000340000-0x0000000000346000-memory.dmp

    Filesize

    24KB

  • memory/2192-55-0x0000000000370000-0x0000000000376000-memory.dmp

    Filesize

    24KB

  • memory/2192-62-0x0000000000230000-0x00000000002B0000-memory.dmp

    Filesize

    512KB