Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    126s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/09/2023, 05:40

General

  • Target

    eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe

  • Size

    1.8MB

  • MD5

    1e678c57bf3f6ba695b0a68a16211b33

  • SHA1

    03e41e6d97b40eccf237d3b01108b0b44fcd85ce

  • SHA256

    eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873

  • SHA512

    91fef12d5b016c315cb0e2df8cb52609959415ef41d2bba097a22b36424ad63e0cd0bad96489e20ab1718f1836a8f508f4c102bfaea1762e26d65df66f81c135

  • SSDEEP

    49152:HdgfeYRUHTBeIGGoSntswWSSG+9UFibEBs/F6:HmPRSTBcSllSG8UFibWs/U

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe
    "C:\Users\Admin\AppData\Local\Temp\eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -S O2dyJ.d
      2⤵
      • Loads dropped DLL
      PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\O2dyJ.d

    Filesize

    1.4MB

    MD5

    068c04dbeb88b9eadd0a40fc3c0c1764

    SHA1

    65e2ca692631bba69c6c6fc652eefc29d47e44ed

    SHA256

    062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8

    SHA512

    1843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb

  • \Users\Admin\AppData\Local\Temp\o2dyJ.d

    Filesize

    1.4MB

    MD5

    068c04dbeb88b9eadd0a40fc3c0c1764

    SHA1

    65e2ca692631bba69c6c6fc652eefc29d47e44ed

    SHA256

    062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8

    SHA512

    1843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb

  • memory/1300-7-0x0000000010000000-0x0000000010167000-memory.dmp

    Filesize

    1.4MB

  • memory/1300-6-0x0000000000920000-0x0000000000926000-memory.dmp

    Filesize

    24KB

  • memory/1300-10-0x0000000004580000-0x000000000468D000-memory.dmp

    Filesize

    1.1MB

  • memory/1300-11-0x0000000004690000-0x0000000004783000-memory.dmp

    Filesize

    972KB

  • memory/1300-14-0x0000000004690000-0x0000000004783000-memory.dmp

    Filesize

    972KB

  • memory/1300-15-0x0000000004690000-0x0000000004783000-memory.dmp

    Filesize

    972KB