Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

0229b0ed26...57.exe

windows7-x64

10

0229b0ed26...57.exe

windows10-2004-x64

10

048b7d1176...04.exe

windows7-x64

10

048b7d1176...04.exe

windows10-2004-x64

10

0f9f03bf48...ae.exe

windows7-x64

10

0f9f03bf48...ae.exe

windows10-2004-x64

10

13047f8cb7...6b.exe

windows7-x64

1

13047f8cb7...6b.exe

windows10-2004-x64

1

13c6577c68...d4.exe

windows7-x64

7

13c6577c68...d4.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 05:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    048b7d11768267d538ae8066805e65a387d52c90ecfd929f695866120e853904.exe

  • Size

    246KB

  • MD5

    97c63287dccb656315141f20f5a45b8f

  • SHA1

    8b2fb42275776d7dabd55e1b96ff82f394defe09

  • SHA256

    048b7d11768267d538ae8066805e65a387d52c90ecfd929f695866120e853904

  • SHA512

    314eba2deaba3643871d745960e15d74604605bd97c1b6f33b86b256c7ce5742e42eb84b724e2df3284de779677aba68add7ca294eb946d85cc3ea7c51b17a48

  • SSDEEP

    6144:1DrlZz/NwysubrnBp/RCFmaaVHEuQJJ+tMdZVHHB5Y:llF/NbLrPRCFQH0Jw/

Score
10/10
systembcpersistencetrojan

Malware Config

Extracted

Family

systembc

C2

45.91.203.197:443

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\048b7d11768267d538ae8066805e65a387d52c90ecfd929f695866120e853904.exe
    "C:\Users\Admin\AppData\Local\Temp\048b7d11768267d538ae8066805e65a387d52c90ecfd929f695866120e853904.exe"
    1⤵
    • Adds Run key to start application
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3028-0-0x0000000000070000-0x0000000000076000-memory.dmp

    Filesize

    24KB

    Download