Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    16/07/2023, 13:21

General

  • Target

    731cae0cdf0f99_JC.exe

  • Size

    62KB

  • MD5

    731cae0cdf0f991eb761bc70fe54214e

  • SHA1

    d5eb00140a2d20e17a285d3651469a508d0b4a7a

  • SHA256

    2e386bea909fa70b61b495012677ebff3293165fe575ecd8980dbfcc149c5250

  • SHA512

    1672ed7bf20177c59b75ca79c6f128a46e7585380ae596f6dbaf775125e5da45441bd05411a3b58156db5b7714f763c92a57315885a0c98987b5828c189a6ce8

  • SSDEEP

    1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1cKtbiM5:vCjsIOtEvwDpj5Hv0lG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\731cae0cdf0f99_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\731cae0cdf0f99_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2148

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    62KB

    MD5

    04a7d9ef9729a30388b04271a3dff1f5

    SHA1

    f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894

    SHA256

    b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6

    SHA512

    4b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    62KB

    MD5

    04a7d9ef9729a30388b04271a3dff1f5

    SHA1

    f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894

    SHA256

    b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6

    SHA512

    4b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    62KB

    MD5

    04a7d9ef9729a30388b04271a3dff1f5

    SHA1

    f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894

    SHA256

    b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6

    SHA512

    4b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020

  • memory/2148-69-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/2148-70-0x0000000000420000-0x0000000000426000-memory.dmp

    Filesize

    24KB

  • memory/2560-54-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2560-55-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2560-58-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB