Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

0cb5271fee...f3.exe

windows7-x64

7

0cb5271fee...f3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2023, 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3.exe

  • Size

    5.4MB

  • MD5

    8dcd7b7985f4854663dfa7fdc5319f8f

  • SHA1

    190c28ffff971c3ff61b84e665381b4694a68e3d

  • SHA256

    0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3

  • SHA512

    328d7f7ed6a0081394052f83368a31e9064cbc9ee43c5fcea36a708a8a61110356b85ca95052ff834a265d97ad8264f8330d7e212ea38e1c9bcdc1e2633674a9

  • SSDEEP

    98304:yTIuG9odiQD9JIDIq+YKQyWmQPIDbuxa7y8zdctTBxQDR0dp7rFLOAkGkzdnEVoe:yPG9rcTXbuL8zdctdSCdRrFLOyomFHKu

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3.exe
    "C:\Users\Admin\AppData\Local\Temp\0cb5271feef473f4e724496b1bdc31d2b3ae4f3f0458cb3361e56860e8cfd1f3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\l2.exe
      "C:\Users\Admin\AppData\Local\Temp\l2.exe"
      2⤵
      • Executes dropped EXE
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\l2.exe
    Filesize

    480KB

    MD5

    23566916e2f5f164ff752e23d8c61491

    SHA1

    5955e26b53e999561a9507444a2997dbdefcb258

    SHA256

    790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee

    SHA512

    90b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\l2.exe
    Filesize

    480KB

    MD5

    23566916e2f5f164ff752e23d8c61491

    SHA1

    5955e26b53e999561a9507444a2997dbdefcb258

    SHA256

    790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee

    SHA512

    90b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\clinkm2.data
    Filesize

    4KB

    MD5

    694ac1fba8e7b697817713774ad701f4

    SHA1

    24dd71466e4c54e2d7027802f5fa6c40bf8cac3c

    SHA256

    31eb97fd14390343a86af304835b954837e88a5ab3a42f261186a61a0f978bfd

    SHA512

    e546ce0d62ebbdd3e4eadedb4d333d13f792da416f792d5b1a4719372c26b3b869d7f31739ba29b6483c37d48b1ecfe6a1521d8496469bb691b9c683780190b2

    Download Submit

  • \Users\Admin\AppData\Local\Temp\l2.exe
    Filesize

    480KB

    MD5

    23566916e2f5f164ff752e23d8c61491

    SHA1

    5955e26b53e999561a9507444a2997dbdefcb258

    SHA256

    790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee

    SHA512

    90b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\l2.exe
    Filesize

    480KB

    MD5

    23566916e2f5f164ff752e23d8c61491

    SHA1

    5955e26b53e999561a9507444a2997dbdefcb258

    SHA256

    790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee

    SHA512

    90b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d

    Download Submit

  • \Users\Admin\AppData\Local\Temp\l2.exe
    Filesize

    480KB

    MD5

    23566916e2f5f164ff752e23d8c61491

    SHA1

    5955e26b53e999561a9507444a2997dbdefcb258

    SHA256

    790d9068796714389d82a400d14d26dcb9e6ecdfc6c2b5eba92ebd1a441b10ee

    SHA512

    90b1a91dff7675ddd840e62036af31fe61fb3ac7cddb9e079db6c4293258985052e086883d380a685fb78915d40fc308b896589d7f5e305289f86673a0739c9d

    Download Submit