Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 08:04

General

  • Target

    7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe

  • Size

    79KB

  • MD5

    e06f2e989fad7db423ef3d9ba314276d

  • SHA1

    e1c9173ffbb74a2fe54a67e1dc5c5611a7bfda07

  • SHA256

    7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e

  • SHA512

    75e5094d026eb1893d2b318b8334b6162aaf9d19bb5b802d6f5e101c2b1be5b63affcb5166e01aba50b5262a552c7d7197d3fddb7b5a782890f5dbd90cb3d8af

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOy69G:GhfxHNIreQm+Hiz69G

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe
    "C:\Users\Admin\AppData\Local\Temp\7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    73KB

    MD5

    004ea4d849ef6f626527ef2721f1170f

    SHA1

    2abcb0b17c17cbf81b2e5326ee9de0231eaa5d9c

    SHA256

    03eb2ab923f6fd72173673c4373b6a53c013807c89625c8faf77d77dbdcbafdd

    SHA512

    042c9c67b0015a7aee5e8d78d8c5e7b774036d94651893890704d91f83d2c984fbbf14b0d71124c374c7b0a7fbac956b9845f10c63ae29e8a0080bb6d160a9ca

  • C:\Windows\System\rundll32.exe

    Filesize

    81KB

    MD5

    b9b5d77175a767f0712a1312671a8552

    SHA1

    1646be2882acbadd0a4df81e051ea4a518d6a615

    SHA256

    38698789b0e58f7e4f4923eec3d060e65b4c0b697fb8c3ac21d58f0d92dc8839

    SHA512

    b763773831d8239786c485d1da96b9897afcd7ef6e9f930ea4e58f0c776331eae21b7e9d626fb504806fdaa7438750cf6b36c36cf10e0e609de356c4411afc36

  • C:\Windows\system\rundll32.exe

    Filesize

    81KB

    MD5

    b9b5d77175a767f0712a1312671a8552

    SHA1

    1646be2882acbadd0a4df81e051ea4a518d6a615

    SHA256

    38698789b0e58f7e4f4923eec3d060e65b4c0b697fb8c3ac21d58f0d92dc8839

    SHA512

    b763773831d8239786c485d1da96b9897afcd7ef6e9f930ea4e58f0c776331eae21b7e9d626fb504806fdaa7438750cf6b36c36cf10e0e609de356c4411afc36

  • memory/2056-14-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/4920-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/4920-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB