Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/07/2023, 13:53

General

  • Target

    b838edd541829b_JC.exe

  • Size

    2.1MB

  • MD5

    b838edd541829beb6c708fdb45ca94c6

  • SHA1

    e9869626fb54ad414ae7c6684c1fa905067c680c

  • SHA256

    73fb4f2ef418b2bdf578f09df324711cbcd4689e4f622b7944aefa0317b2c1a0

  • SHA512

    2be06750abc00b28b87cbe84f1e59be3325175c4cf227263960f999bbd1a7f2d18cec967c39b6d3a68f4c3709af05471e9bbc4c4d80fe5886bfafc28d602e2db

  • SSDEEP

    24576:8i5WyAHIlqh2hvhuQZlNVHhZ4H9w0Z2CCwaYJoRk:8i5QwuQZlNVB0w0HCwaYJom

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b838edd541829b_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\b838edd541829b_JC.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1184

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2040-55-0x0000000005F70000-0x0000000005F71000-memory.dmp

      Filesize

      4KB

    • memory/2040-56-0x0000000005F80000-0x0000000005F82000-memory.dmp

      Filesize

      8KB

    • memory/2040-57-0x0000000005F70000-0x0000000005F71000-memory.dmp

      Filesize

      4KB