Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    16/07/2023, 12:42

General

  • Target

    6e49e7126b5745_JC.exe

  • Size

    63KB

  • MD5

    6e49e7126b57458968239a05b690486b

  • SHA1

    c1a727548a4f5a55b02fdad630dd38adaa4f47a3

  • SHA256

    935f82a18f59e081a15bc172c7a050aca35505aa9e5a7ffad8ecbe033c34b388

  • SHA512

    903d23cb9faac4dd1181586cf1d8b36c73d7b4dc230cb3b726aff940d2b54eba8e27b40b713a140b7c3aa4d5c95b63c5e3df1bc79a740adb497f91920a1b08e3

  • SSDEEP

    1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xo3/nyxa:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7j

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e49e7126b5745_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\6e49e7126b5745_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Users\Admin\AppData\Local\Temp\hurok.exe
      "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2380

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    63KB

    MD5

    f494b62fc923c5354621ebb01a04fbc6

    SHA1

    e8670dce438f96926f68c984571ebafd61ddaff1

    SHA256

    d721da2ad664d0cb9c216ee1ae814d9e2ebce23b071a2e9ea547acb35e498f4c

    SHA512

    8ace4664260e64967d7a88ae05ec17a3ce39c817f8285c03a74022176d20b37da6f55690a58d474a5375fc7ce2a07be181d085b34b3ac9b054a8c862e964c7c2

  • C:\Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    63KB

    MD5

    f494b62fc923c5354621ebb01a04fbc6

    SHA1

    e8670dce438f96926f68c984571ebafd61ddaff1

    SHA256

    d721da2ad664d0cb9c216ee1ae814d9e2ebce23b071a2e9ea547acb35e498f4c

    SHA512

    8ace4664260e64967d7a88ae05ec17a3ce39c817f8285c03a74022176d20b37da6f55690a58d474a5375fc7ce2a07be181d085b34b3ac9b054a8c862e964c7c2

  • \Users\Admin\AppData\Local\Temp\hurok.exe

    Filesize

    63KB

    MD5

    f494b62fc923c5354621ebb01a04fbc6

    SHA1

    e8670dce438f96926f68c984571ebafd61ddaff1

    SHA256

    d721da2ad664d0cb9c216ee1ae814d9e2ebce23b071a2e9ea547acb35e498f4c

    SHA512

    8ace4664260e64967d7a88ae05ec17a3ce39c817f8285c03a74022176d20b37da6f55690a58d474a5375fc7ce2a07be181d085b34b3ac9b054a8c862e964c7c2

  • memory/1428-53-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/1428-54-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1428-55-0x00000000001C0000-0x00000000001C6000-memory.dmp

    Filesize

    24KB

  • memory/2380-70-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB