Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    16/07/2023, 08:13

General

  • Target

    587b2f71db722f_JC.exe

  • Size

    65KB

  • MD5

    587b2f71db722f195b2e41ca2bd86a56

  • SHA1

    6cb2bcec63c13b389275691f603ce7d7979fef56

  • SHA256

    06abf045fc0cbd8e7c4962aea5a473473f5863ac62d2f8f293cebd69d6d3d807

  • SHA512

    98e3fae9db735fe22ea9359f753e467814771d57f7ca5c0361f3ce4425cb7ecef957b8f0b30b349e1b7478a5f560310bb471d2a763f1b3fae4cff2870b400737

  • SSDEEP

    1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ36n9FQ/zZ:ZVxkGOtEvwDpjcaAw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\587b2f71db722f_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\587b2f71db722f_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2932

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    65KB

    MD5

    fbfceaa7495d3600f176807a0b1cd9e3

    SHA1

    a7afeca4f00056507a324a142c1b7f5a45f95176

    SHA256

    b833d73312258a5cd9708bc258d009f578dc3201d57d3a44e942864fa33d2eb8

    SHA512

    9b1a34b83c36c8e17316a337a192ba1c2a6273bbe753d14401b27d956550b69f394f867ec07e3aa227db295b89b5031ed855804b69cae06178d99ca76458ebff

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    65KB

    MD5

    fbfceaa7495d3600f176807a0b1cd9e3

    SHA1

    a7afeca4f00056507a324a142c1b7f5a45f95176

    SHA256

    b833d73312258a5cd9708bc258d009f578dc3201d57d3a44e942864fa33d2eb8

    SHA512

    9b1a34b83c36c8e17316a337a192ba1c2a6273bbe753d14401b27d956550b69f394f867ec07e3aa227db295b89b5031ed855804b69cae06178d99ca76458ebff

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    65KB

    MD5

    fbfceaa7495d3600f176807a0b1cd9e3

    SHA1

    a7afeca4f00056507a324a142c1b7f5a45f95176

    SHA256

    b833d73312258a5cd9708bc258d009f578dc3201d57d3a44e942864fa33d2eb8

    SHA512

    9b1a34b83c36c8e17316a337a192ba1c2a6273bbe753d14401b27d956550b69f394f867ec07e3aa227db295b89b5031ed855804b69cae06178d99ca76458ebff

  • memory/1780-54-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/1780-55-0x0000000000230000-0x0000000000270000-memory.dmp

    Filesize

    256KB

  • memory/1780-56-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/1780-57-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/1780-69-0x0000000000230000-0x0000000000270000-memory.dmp

    Filesize

    256KB

  • memory/2932-70-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/2932-72-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2932-79-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2932-80-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB