Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 13:54

General

  • Target

    bddc550e51cad77d4c489d6fe2db177d_JC.exe

  • Size

    72KB

  • MD5

    bddc550e51cad77d4c489d6fe2db177d

  • SHA1

    71c6936c63a1dc0a0748fa271537327f822c2227

  • SHA256

    6569b866a8663b22acaf7f3aacdcc39fe756ebb54221de484db7307fff280614

  • SHA512

    876b8835c67467629d7ff1c35a30aafdd750b7d62d0cc356a4e634bd3132854299af5d02dd6eef3fe1037350c3c6522635608a178c5cf10ab7e69fc3f64a4e0a

  • SSDEEP

    768:TYnI9ZvPg2k4u+hJDdv260OAhAH4Ii7gLp6uqcl2aauA:TwIrHuCtd3FAhAYIi7Glba

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bddc550e51cad77d4c489d6fe2db177d_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\bddc550e51cad77d4c489d6fe2db177d_JC.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Users\Admin\AppData\Roaming\5huo.exe
      C:\Users\Admin\AppData\Roaming\5huo.exe
      2⤵
      • Executes dropped EXE
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\5huo.exe

    Filesize

    72KB

    MD5

    79eb77df0b31228cfcce78ecfc47522d

    SHA1

    0271b33bd805537cf921c169fc95550bdef38655

    SHA256

    af5397a098c88bed2e53a07a5a8fe3bfc8ee999e16e8271029bcb8c9a2f48b97

    SHA512

    207890f1be7a8db45686d689abd7b6389d36d19d62da7cc3bfc74de131b322cf06f32f537d1d90ea09dd06a84e6fac65974fad4b04bdcf6308b1875961594b43

  • C:\Users\Admin\AppData\Roaming\5huo.exe

    Filesize

    72KB

    MD5

    79eb77df0b31228cfcce78ecfc47522d

    SHA1

    0271b33bd805537cf921c169fc95550bdef38655

    SHA256

    af5397a098c88bed2e53a07a5a8fe3bfc8ee999e16e8271029bcb8c9a2f48b97

    SHA512

    207890f1be7a8db45686d689abd7b6389d36d19d62da7cc3bfc74de131b322cf06f32f537d1d90ea09dd06a84e6fac65974fad4b04bdcf6308b1875961594b43

  • C:\Users\Admin\AppData\Roaming\5huo.exe

    Filesize

    72KB

    MD5

    79eb77df0b31228cfcce78ecfc47522d

    SHA1

    0271b33bd805537cf921c169fc95550bdef38655

    SHA256

    af5397a098c88bed2e53a07a5a8fe3bfc8ee999e16e8271029bcb8c9a2f48b97

    SHA512

    207890f1be7a8db45686d689abd7b6389d36d19d62da7cc3bfc74de131b322cf06f32f537d1d90ea09dd06a84e6fac65974fad4b04bdcf6308b1875961594b43

  • \Users\Admin\AppData\Roaming\5huo.exe

    Filesize

    72KB

    MD5

    79eb77df0b31228cfcce78ecfc47522d

    SHA1

    0271b33bd805537cf921c169fc95550bdef38655

    SHA256

    af5397a098c88bed2e53a07a5a8fe3bfc8ee999e16e8271029bcb8c9a2f48b97

    SHA512

    207890f1be7a8db45686d689abd7b6389d36d19d62da7cc3bfc74de131b322cf06f32f537d1d90ea09dd06a84e6fac65974fad4b04bdcf6308b1875961594b43

  • \Users\Admin\AppData\Roaming\5huo.exe

    Filesize

    72KB

    MD5

    79eb77df0b31228cfcce78ecfc47522d

    SHA1

    0271b33bd805537cf921c169fc95550bdef38655

    SHA256

    af5397a098c88bed2e53a07a5a8fe3bfc8ee999e16e8271029bcb8c9a2f48b97

    SHA512

    207890f1be7a8db45686d689abd7b6389d36d19d62da7cc3bfc74de131b322cf06f32f537d1d90ea09dd06a84e6fac65974fad4b04bdcf6308b1875961594b43