Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2023, 03:30

General

  • Target

    e63a676d457b8086be22c770fa4600a34de720129baefb8ce5859a42a4704def.exe

  • Size

    858KB

  • MD5

    dfe0609eaa5cb160874a30d4ae98ae02

  • SHA1

    badd19aec2cdbbec0d9086310320d9c76fa76121

  • SHA256

    e63a676d457b8086be22c770fa4600a34de720129baefb8ce5859a42a4704def

  • SHA512

    cb05e1696cc3a7f19d124e24c58b599b9f4c941af7871bd02285c93580c256eed1a984e9e587d27fb439dca8ca5e7ad3e507806fceb4d11cd2655fae3bd97d72

  • SSDEEP

    6144:i4XtR7Mr2N5Og12D5RiWfqVt8WHs65k/9W+1IY9TmKnxX8yphiAzKQBVEeXabgIS:iaR7Z5OgImU

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\e63a676d457b8086be22c770fa4600a34de720129baefb8ce5859a42a4704def.exe
        "C:\Users\Admin\AppData\Local\Temp\e63a676d457b8086be22c770fa4600a34de720129baefb8ce5859a42a4704def.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Users\Admin\AppData\Local\Temp\e63a676d457b8086be22c770fa4600a34de720129baefb8ce5859a42a4704def.exe
          "C:\Users\Admin\AppData\Local\Temp\e63a676d457b8086be22c770fa4600a34de720129baefb8ce5859a42a4704def.exe"
          3⤵
            PID:2248

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1256-4-0x0000000002180000-0x0000000002181000-memory.dmp

        Filesize

        4KB

      • memory/1256-5-0x0000000002180000-0x0000000002181000-memory.dmp

        Filesize

        4KB

      • memory/2248-2-0x0000000000A80000-0x0000000000B58458-memory.dmp

        Filesize

        865KB

      • memory/2596-0-0x0000000000A80000-0x0000000000B58458-memory.dmp

        Filesize

        865KB

      • memory/2596-1-0x00000000002B0000-0x0000000000389000-memory.dmp

        Filesize

        868KB

      • memory/2596-6-0x0000000000A80000-0x0000000000B58458-memory.dmp

        Filesize

        865KB