Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 05:25

General

  • Target

    c3cd752cc8c2a83189d4f05cd0bdeef6b8252fb7b2223336af6296dacbacee43.exe

  • Size

    192KB

  • MD5

    712178dd39c6381a5c36c23658dcaad4

  • SHA1

    e00af9b1f82cf038b2596e3e35171b6cb5393e59

  • SHA256

    c3cd752cc8c2a83189d4f05cd0bdeef6b8252fb7b2223336af6296dacbacee43

  • SHA512

    9e7ad4d633c665b831ed7619bcad95a04debec4d05f31bcb3136f31474b802113b10306c2b4be3427eef0e9542b60fef58c7c3d5c25d0bc13cbac0d29f7147f7

  • SSDEEP

    6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOY:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXR

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3cd752cc8c2a83189d4f05cd0bdeef6b8252fb7b2223336af6296dacbacee43.exe
    "C:\Users\Admin\AppData\Local\Temp\c3cd752cc8c2a83189d4f05cd0bdeef6b8252fb7b2223336af6296dacbacee43.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C3CD75~1.EXE > nul
      2⤵
        PID:2800
    • C:\Windows\Debug\jaohost.exe
      C:\Windows\Debug\jaohost.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      PID:1068

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Debug\jaohost.exe

      Filesize

      192KB

      MD5

      e1c6b0a48d35a5aa21ed02a42d220870

      SHA1

      44b7e702116e28d69bc92dfeb6548b508e601143

      SHA256

      936551c8cda2baa23b7c0bf63b1675bad5a09e618ea1f3145eb1cfe2fc2eff7a

      SHA512

      ec0890b1c899e5118609d04e52f07a55b229799fec53ccf8343617203fa90b7010851d100d9be67fb39c92ef0699c0d5699e37522e801622dcd12a79a4010977

    • C:\Windows\debug\jaohost.exe

      Filesize

      192KB

      MD5

      e1c6b0a48d35a5aa21ed02a42d220870

      SHA1

      44b7e702116e28d69bc92dfeb6548b508e601143

      SHA256

      936551c8cda2baa23b7c0bf63b1675bad5a09e618ea1f3145eb1cfe2fc2eff7a

      SHA512

      ec0890b1c899e5118609d04e52f07a55b229799fec53ccf8343617203fa90b7010851d100d9be67fb39c92ef0699c0d5699e37522e801622dcd12a79a4010977