Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 13:52

General

  • Target

    ad7a72ce76aedde5a34f8e586ed4138be0a24a870f6f32e45ae3f9319d5fb476.exe

  • Size

    1.7MB

  • MD5

    9783bec4f09c7463038cab0749c39ffe

  • SHA1

    563de407668db64db3ea1361b7a642d9bc6d0e5b

  • SHA256

    ad7a72ce76aedde5a34f8e586ed4138be0a24a870f6f32e45ae3f9319d5fb476

  • SHA512

    6efa8f3431bcc8de3f6be6ca144aa9a8207bc71095e6bd50f14cdc0ed8ec413d4ecc8260c45cb6f0796fffb625fcbb88233e569c179f35cc9a3882730810c777

  • SSDEEP

    49152:rLLUi3Rx2dOh8Oy1OSlTlqblNDbD0wcY7mDGLQ:r33Rx2d4yASlTl2njcYycQ

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad7a72ce76aedde5a34f8e586ed4138be0a24a870f6f32e45ae3f9319d5fb476.exe
    "C:\Users\Admin\AppData\Local\Temp\ad7a72ce76aedde5a34f8e586ed4138be0a24a870f6f32e45ae3f9319d5fb476.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\3fv5b.CPL",
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3fv5b.CPL",
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\system32\RunDll32.exe
          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3fv5b.CPL",
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2488
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\3fv5b.CPL",
            5⤵
            • Loads dropped DLL
            PID:2508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3fv5b.CPL

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • \Users\Admin\AppData\Local\Temp\3fv5b.cpl

    Filesize

    1.4MB

    MD5

    46e52c1934680f078dc9c8d945891752

    SHA1

    42465cbb04b0f2c1d1858f5a3d1bb3174ad024dc

    SHA256

    53ace6b74aff50bc422f5ca3362f58cb33ed24a8817acc5f09fdfe6a922d0213

    SHA512

    367a0b960860e0aff56cc850590e5d49f348645977c8e99a4f5f2604edbd539b2ea9cee1ec8428f5ae5ebb25e0071783127400b9faa95d190dfbcd0bb45de524

  • memory/2508-30-0x0000000002610000-0x000000000271C000-memory.dmp

    Filesize

    1.0MB

  • memory/2508-31-0x0000000002720000-0x0000000002812000-memory.dmp

    Filesize

    968KB

  • memory/2508-34-0x0000000002720000-0x0000000002812000-memory.dmp

    Filesize

    968KB

  • memory/2508-35-0x0000000002720000-0x0000000002812000-memory.dmp

    Filesize

    968KB

  • memory/2696-18-0x00000000026A0000-0x0000000002792000-memory.dmp

    Filesize

    968KB

  • memory/2696-19-0x00000000026A0000-0x0000000002792000-memory.dmp

    Filesize

    968KB

  • memory/2696-15-0x00000000026A0000-0x0000000002792000-memory.dmp

    Filesize

    968KB

  • memory/2696-14-0x0000000001F50000-0x000000000205C000-memory.dmp

    Filesize

    1.0MB

  • memory/2696-9-0x0000000000190000-0x0000000000196000-memory.dmp

    Filesize

    24KB

  • memory/2696-8-0x0000000010000000-0x0000000010165000-memory.dmp

    Filesize

    1.4MB