Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 04:02

General

  • Target

    dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f.exe

  • Size

    937KB

  • MD5

    5466d6e8f7e190b0db624958b4844b7c

  • SHA1

    e576c4888e5a290f3aa33316000a38cfb92e94b2

  • SHA256

    dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f

  • SHA512

    0406528fe4370dc8de9cf6ac81f46376542470a14d36154ac3e387325bca14043481e7998f241162ae2b63c7dcc872052d5ffbaf8cb03c399b6e8efa6fb4e36e

  • SSDEEP

    24576:LybIieayuBpxxQ5UhhimHTY/9BGL5IBNUL+Pi5MSEbC9HnHE8k:+buMrxlhZHs/iL5IBNhPEu2

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f.exe
    "C:\Users\Admin\AppData\Local\Temp\dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2900
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2672
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 268
                7⤵
                • Program crash
                PID:2848
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 272
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe

    Filesize

    836KB

    MD5

    de825d1dd2075e37acd6d65d78b2b3cf

    SHA1

    841cbfd6470eda445b82056e6b0325949a388dfa

    SHA256

    32297758761cd491cf8fe2a198d277f4fd844ebb1e2867d7b025c9085513dc9f

    SHA512

    12768a8e11eab3108bc5dbf5c96b8b291f8a0f1f2b61787fce25161b0998010afc0aae15d302fe385dd5d043ac350f1502d20e9ebf6ba95ea75268417e3f1413

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe

    Filesize

    836KB

    MD5

    de825d1dd2075e37acd6d65d78b2b3cf

    SHA1

    841cbfd6470eda445b82056e6b0325949a388dfa

    SHA256

    32297758761cd491cf8fe2a198d277f4fd844ebb1e2867d7b025c9085513dc9f

    SHA512

    12768a8e11eab3108bc5dbf5c96b8b291f8a0f1f2b61787fce25161b0998010afc0aae15d302fe385dd5d043ac350f1502d20e9ebf6ba95ea75268417e3f1413

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe

    Filesize

    571KB

    MD5

    c3c0ecc8ef0cebe910c75b4452999cba

    SHA1

    7269cd2ba945159955e542c94f1b2dd9ba06650f

    SHA256

    1dbed4c0b9a383e4c8a944b4a6a04f1a3e1042c7b590fd05c42e0cb67acdd264

    SHA512

    09791bb8d270ecdcbdd1b4b2ab45f711cccd2d1035a30efb82df4b69749d63439213043ecad251946ea2ee2ba41eac29bdb771d8ca8cf03e9361a18254e71813

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe

    Filesize

    571KB

    MD5

    c3c0ecc8ef0cebe910c75b4452999cba

    SHA1

    7269cd2ba945159955e542c94f1b2dd9ba06650f

    SHA256

    1dbed4c0b9a383e4c8a944b4a6a04f1a3e1042c7b590fd05c42e0cb67acdd264

    SHA512

    09791bb8d270ecdcbdd1b4b2ab45f711cccd2d1035a30efb82df4b69749d63439213043ecad251946ea2ee2ba41eac29bdb771d8ca8cf03e9361a18254e71813

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe

    Filesize

    394KB

    MD5

    40b9226a7da2e7b42b051cfd8b0cc5be

    SHA1

    3e68d73e14696acb245a233472797a8aec8aa7c2

    SHA256

    258df03e7af46a9bdb068ebabdea47cb8e9797ab23863470495890f9f036fa25

    SHA512

    f391c913f73dfe092cde125c7283f6f9d64d61056dc34badc00eca1896379631adc40884cc82c0a547f1b060fd86ef56aae04c87fe7d0be93472db400dbc0cd0

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe

    Filesize

    394KB

    MD5

    40b9226a7da2e7b42b051cfd8b0cc5be

    SHA1

    3e68d73e14696acb245a233472797a8aec8aa7c2

    SHA256

    258df03e7af46a9bdb068ebabdea47cb8e9797ab23863470495890f9f036fa25

    SHA512

    f391c913f73dfe092cde125c7283f6f9d64d61056dc34badc00eca1896379631adc40884cc82c0a547f1b060fd86ef56aae04c87fe7d0be93472db400dbc0cd0

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe

    Filesize

    836KB

    MD5

    de825d1dd2075e37acd6d65d78b2b3cf

    SHA1

    841cbfd6470eda445b82056e6b0325949a388dfa

    SHA256

    32297758761cd491cf8fe2a198d277f4fd844ebb1e2867d7b025c9085513dc9f

    SHA512

    12768a8e11eab3108bc5dbf5c96b8b291f8a0f1f2b61787fce25161b0998010afc0aae15d302fe385dd5d043ac350f1502d20e9ebf6ba95ea75268417e3f1413

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe

    Filesize

    836KB

    MD5

    de825d1dd2075e37acd6d65d78b2b3cf

    SHA1

    841cbfd6470eda445b82056e6b0325949a388dfa

    SHA256

    32297758761cd491cf8fe2a198d277f4fd844ebb1e2867d7b025c9085513dc9f

    SHA512

    12768a8e11eab3108bc5dbf5c96b8b291f8a0f1f2b61787fce25161b0998010afc0aae15d302fe385dd5d043ac350f1502d20e9ebf6ba95ea75268417e3f1413

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe

    Filesize

    571KB

    MD5

    c3c0ecc8ef0cebe910c75b4452999cba

    SHA1

    7269cd2ba945159955e542c94f1b2dd9ba06650f

    SHA256

    1dbed4c0b9a383e4c8a944b4a6a04f1a3e1042c7b590fd05c42e0cb67acdd264

    SHA512

    09791bb8d270ecdcbdd1b4b2ab45f711cccd2d1035a30efb82df4b69749d63439213043ecad251946ea2ee2ba41eac29bdb771d8ca8cf03e9361a18254e71813

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe

    Filesize

    571KB

    MD5

    c3c0ecc8ef0cebe910c75b4452999cba

    SHA1

    7269cd2ba945159955e542c94f1b2dd9ba06650f

    SHA256

    1dbed4c0b9a383e4c8a944b4a6a04f1a3e1042c7b590fd05c42e0cb67acdd264

    SHA512

    09791bb8d270ecdcbdd1b4b2ab45f711cccd2d1035a30efb82df4b69749d63439213043ecad251946ea2ee2ba41eac29bdb771d8ca8cf03e9361a18254e71813

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe

    Filesize

    394KB

    MD5

    40b9226a7da2e7b42b051cfd8b0cc5be

    SHA1

    3e68d73e14696acb245a233472797a8aec8aa7c2

    SHA256

    258df03e7af46a9bdb068ebabdea47cb8e9797ab23863470495890f9f036fa25

    SHA512

    f391c913f73dfe092cde125c7283f6f9d64d61056dc34badc00eca1896379631adc40884cc82c0a547f1b060fd86ef56aae04c87fe7d0be93472db400dbc0cd0

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe

    Filesize

    394KB

    MD5

    40b9226a7da2e7b42b051cfd8b0cc5be

    SHA1

    3e68d73e14696acb245a233472797a8aec8aa7c2

    SHA256

    258df03e7af46a9bdb068ebabdea47cb8e9797ab23863470495890f9f036fa25

    SHA512

    f391c913f73dfe092cde125c7283f6f9d64d61056dc34badc00eca1896379631adc40884cc82c0a547f1b060fd86ef56aae04c87fe7d0be93472db400dbc0cd0

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

    Filesize

    365KB

    MD5

    01c404e834818ca8eabe9fe6c322cd4a

    SHA1

    7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

    SHA256

    2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

    SHA512

    1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

  • memory/2672-43-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-42-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-41-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-40-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-49-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-51-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-46-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2672-47-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-45-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2672-44-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB