Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 04:54

General

  • Target

    78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe

  • Size

    1.6MB

  • MD5

    5ef602e9059c1bb09594b28dcdc164e4

  • SHA1

    aa7d5f68fcf83c4e06237e8fadde070c660292e4

  • SHA256

    78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2

  • SHA512

    b64a6b069a1ce2e6295541160ed6264f25580d196bc86c055c2e2a1550833d74f118e23badc0226130841d153ed57102b7cb6a21a16300a82dd9ac1147ead386

  • SSDEEP

    49152:CvxfXTMRuwHOWKw7kTtCTdxH/eSTdjYhCyU:CvxwRuw9Kw7k8Td9eSJYhCyU

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe
    "C:\Users\Admin\AppData\Local\Temp\78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Windows\system32\RunDll32.exe
          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2680
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",
            5⤵
            • Loads dropped DLL
            PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • \Users\Admin\AppData\Local\Temp\8ez1i.cpl

    Filesize

    1.4MB

    MD5

    b98f29b60d2677d00e5707b844f6b298

    SHA1

    dce9c97e53cb59cec3f6f628d933d4be24f3c707

    SHA256

    aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35

    SHA512

    48498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb

  • memory/1612-8-0x0000000000170000-0x0000000000176000-memory.dmp

    Filesize

    24KB

  • memory/1612-9-0x0000000010000000-0x0000000010171000-memory.dmp

    Filesize

    1.4MB

  • memory/1612-20-0x00000000027E0000-0x00000000028CB000-memory.dmp

    Filesize

    940KB

  • memory/1612-21-0x00000000027E0000-0x00000000028CB000-memory.dmp

    Filesize

    940KB

  • memory/1612-17-0x00000000027E0000-0x00000000028CB000-memory.dmp

    Filesize

    940KB

  • memory/1612-16-0x00000000026D0000-0x00000000027D3000-memory.dmp

    Filesize

    1.0MB

  • memory/1612-12-0x0000000000170000-0x0000000000176000-memory.dmp

    Filesize

    24KB

  • memory/1612-18-0x00000000027E0000-0x00000000028CB000-memory.dmp

    Filesize

    940KB

  • memory/2684-26-0x0000000000160000-0x0000000000166000-memory.dmp

    Filesize

    24KB

  • memory/2684-34-0x0000000002540000-0x0000000002643000-memory.dmp

    Filesize

    1.0MB

  • memory/2684-35-0x0000000002650000-0x000000000273B000-memory.dmp

    Filesize

    940KB

  • memory/2684-36-0x0000000002650000-0x000000000273B000-memory.dmp

    Filesize

    940KB

  • memory/2684-38-0x0000000002650000-0x000000000273B000-memory.dmp

    Filesize

    940KB

  • memory/2684-39-0x0000000002650000-0x000000000273B000-memory.dmp

    Filesize

    940KB