Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/07/2023, 14:24

General

  • Target

    bba48bf134953b_JC.exe

  • Size

    78KB

  • MD5

    bba48bf134953bb4279d96eae4e30a77

  • SHA1

    e6dbe66a2e7972857a663b4d5298e98a44206813

  • SHA256

    cd0d26e20d879311e56ba7f57683e25eca1983eba16c58abb2b591373ee723c5

  • SHA512

    46a4b02c8e9a8c6553169e078093a6ae3f97a1c6073c381cfda664cb7d89e7d1eef23efe66e8f0d99619898c13d2010a180ca3050713ac0d03fe317630c88ed6

  • SSDEEP

    1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDSnU3:1nK6a+qdOOtEvwDpjc

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bba48bf134953b_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\bba48bf134953b_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2324

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    78KB

    MD5

    4de4e2e5b7da7306336429e860b2b404

    SHA1

    a5943b8d5cc664c1f466b140519186b43c57cc21

    SHA256

    5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

    SHA512

    ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    78KB

    MD5

    4de4e2e5b7da7306336429e860b2b404

    SHA1

    a5943b8d5cc664c1f466b140519186b43c57cc21

    SHA256

    5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

    SHA512

    ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    78KB

    MD5

    4de4e2e5b7da7306336429e860b2b404

    SHA1

    a5943b8d5cc664c1f466b140519186b43c57cc21

    SHA256

    5a44166319be0571ff8eb6892fb0d6bc5d078e40af203489a23805a8397c56b4

    SHA512

    ba76c054040ea0d02e28e61c910f9be0a3354f4c1d2ce441e4a5abac6e1a9b2f35b0c0852884eb611cdc4be351309dcbd34c8edae1d828c6e64f065c6410769a

  • memory/2324-73-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2324-72-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2324-74-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2324-82-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2564-69-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2564-57-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2564-68-0x0000000001D70000-0x0000000001D80000-memory.dmp

    Filesize

    64KB

  • memory/2564-56-0x0000000000200000-0x0000000000206000-memory.dmp

    Filesize

    24KB

  • memory/2564-54-0x0000000000500000-0x000000000050F311-memory.dmp

    Filesize

    60KB

  • memory/2564-55-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2564-81-0x0000000001D70000-0x0000000001D80000-memory.dmp

    Filesize

    64KB