Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2023, 00:45

General

  • Target

    98a25126c61c4ff98680f65df8e9bcc270407c8a2cd2774006f8ada6840b22cd.exe

  • Size

    77KB

  • MD5

    0cf58602659903e8ee362ff25867ded8

  • SHA1

    400d1b5a2c4bec734fcdd2ba4739b2e7588fa405

  • SHA256

    98a25126c61c4ff98680f65df8e9bcc270407c8a2cd2774006f8ada6840b22cd

  • SHA512

    0081de69c7a92ec95b2ebbc2eb53ea7994654465fe74822a8d5a5f9d59000f6363a39f8e98294cc9e003b36c76c83753201468de73bec75a2ce93b9338e337de

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOkVc7kG:GhfxHNIreQm+HivVc7kG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98a25126c61c4ff98680f65df8e9bcc270407c8a2cd2774006f8ada6840b22cd.exe
    "C:\Users\Admin\AppData\Local\Temp\98a25126c61c4ff98680f65df8e9bcc270407c8a2cd2774006f8ada6840b22cd.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    86KB

    MD5

    2a5d52ccfa8c9b1c647d292e2c41b366

    SHA1

    4b6ae79566ef85ebf033fd8673d302581e8677c4

    SHA256

    87c555320c45b17420ad596bc8d473f23d61e22124443eef30aa8e5bfa1fc786

    SHA512

    b7e2c9352a0bf88ec896196a1910425996b341f6230a42d5ab1f6cc2c94b42aa0b02cf517beb1a33dd9fc1e94d47527d7d210c79659550f1ebf7b97f12171a0c

  • C:\Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    0c14d898a8e1e2a1dad8071a9b7210dc

    SHA1

    aa7ac0ffe9ff4f1e1077c2b9ae27a0c2caa78f67

    SHA256

    b6fa2fa541b77492a36ef4e88a6153374226055b14f1e042bb5a02d271a009b7

    SHA512

    2c0d30c4e5bcedca3c34d4564dca5913cf4311c854cb19209dae1bb12af8fd3851739267bcc06bf0731e2919b7625b8e17560afff1faa4a47e16f5007dce0c28

  • C:\Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    0c14d898a8e1e2a1dad8071a9b7210dc

    SHA1

    aa7ac0ffe9ff4f1e1077c2b9ae27a0c2caa78f67

    SHA256

    b6fa2fa541b77492a36ef4e88a6153374226055b14f1e042bb5a02d271a009b7

    SHA512

    2c0d30c4e5bcedca3c34d4564dca5913cf4311c854cb19209dae1bb12af8fd3851739267bcc06bf0731e2919b7625b8e17560afff1faa4a47e16f5007dce0c28

  • \Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    0c14d898a8e1e2a1dad8071a9b7210dc

    SHA1

    aa7ac0ffe9ff4f1e1077c2b9ae27a0c2caa78f67

    SHA256

    b6fa2fa541b77492a36ef4e88a6153374226055b14f1e042bb5a02d271a009b7

    SHA512

    2c0d30c4e5bcedca3c34d4564dca5913cf4311c854cb19209dae1bb12af8fd3851739267bcc06bf0731e2919b7625b8e17560afff1faa4a47e16f5007dce0c28

  • \Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    0c14d898a8e1e2a1dad8071a9b7210dc

    SHA1

    aa7ac0ffe9ff4f1e1077c2b9ae27a0c2caa78f67

    SHA256

    b6fa2fa541b77492a36ef4e88a6153374226055b14f1e042bb5a02d271a009b7

    SHA512

    2c0d30c4e5bcedca3c34d4564dca5913cf4311c854cb19209dae1bb12af8fd3851739267bcc06bf0731e2919b7625b8e17560afff1faa4a47e16f5007dce0c28

  • memory/2968-20-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2968-23-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/3020-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/3020-12-0x0000000000240000-0x0000000000256000-memory.dmp

    Filesize

    88KB

  • memory/3020-17-0x0000000000240000-0x0000000000256000-memory.dmp

    Filesize

    88KB

  • memory/3020-21-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/3020-22-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB