Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 20:57

General

  • Target

    tmp.exe

  • Size

    11.5MB

  • MD5

    3832f42b8a1655a1ff2cce00aec7435b

  • SHA1

    d3947a80f0c1aa1c7f743fcaa74b949ee35b1c83

  • SHA256

    87fb26371ed0229ba3706a76b11520bfe751a443e6598fa39d2a382facfb67eb

  • SHA512

    f26048366df42d3978422a8b02c99b9b43610cf0e3e9b449c1a5280af7b4319feb9f20c7852698783bdc3ed6156b066a1cfd359d4caff46d44548277e0b473bb

  • SSDEEP

    196608:9Wpurk8eVGB94/PByD/pUwjD7Qy9L4EfOaKONEagH+Y5afzyiyenR+hhcZl:TIVLXMrpJ8y9Lr2XnH+YAOi9+hGb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\onefile_2976_133414476290304000\loadder.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_2976_133414476290304000\loadder.exe

    Filesize

    21.3MB

    MD5

    87cca57fb4e1e11e5662a70f7eb4354f

    SHA1

    e15cc5f747bff5b209fdbcff3aefd204155308f3

    SHA256

    3f4c039beaa990f95e1aac8fcc9cc366a69139189a95eaeafa12d78c73be5bab

    SHA512

    52a14d3aa63f409b770510d822ca04528ee163507787ec46cfb48a1dfc76da13a3013348232302eac1d4011197386e960b04db761aa7520f29a62be0b3fb7c81

  • C:\Users\Admin\AppData\Local\Temp\onefile_2976_133414476290304000\python311.dll

    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

  • \Users\Admin\AppData\Local\Temp\onefile_2976_133414476290304000\loadder.exe

    Filesize

    21.3MB

    MD5

    87cca57fb4e1e11e5662a70f7eb4354f

    SHA1

    e15cc5f747bff5b209fdbcff3aefd204155308f3

    SHA256

    3f4c039beaa990f95e1aac8fcc9cc366a69139189a95eaeafa12d78c73be5bab

    SHA512

    52a14d3aa63f409b770510d822ca04528ee163507787ec46cfb48a1dfc76da13a3013348232302eac1d4011197386e960b04db761aa7520f29a62be0b3fb7c81

  • \Users\Admin\AppData\Local\Temp\onefile_2976_133414476290304000\python311.dll

    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

  • memory/2772-49-0x000000013FE50000-0x00000001413F0000-memory.dmp

    Filesize

    21.6MB