Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2023, 21:58

General

  • Target

    4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe

  • Size

    816KB

  • MD5

    aac316903de887646b41713942062cd2

  • SHA1

    3a9875685d6e4fa4a45352d3556c6cf8c3818fb5

  • SHA256

    4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116

  • SHA512

    8384334b1b9686c3a3d1fbc28f2f1ed6ebf41bec86fc5262bf4531db70304916a4d24e461a54eb17b6aa21cc41c4f1a5187d090d0a3d3b882cc745715ecf8b04

  • SSDEEP

    24576:pY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9+:G3XZynV4oDabuWbDQOcIxJJ9+

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
    "C:\Users\Admin\AppData\Local\Temp\4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe
      C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

    Filesize

    816KB

    MD5

    f0da1442a179d4074cfb10acffa66631

    SHA1

    e2fca5d7b810ad9086a23d3db7312112a202e6e9

    SHA256

    ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

    SHA512

    18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

  • C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

    Filesize

    816KB

    MD5

    f0da1442a179d4074cfb10acffa66631

    SHA1

    e2fca5d7b810ad9086a23d3db7312112a202e6e9

    SHA256

    ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

    SHA512

    18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

  • \Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

    Filesize

    816KB

    MD5

    f0da1442a179d4074cfb10acffa66631

    SHA1

    e2fca5d7b810ad9086a23d3db7312112a202e6e9

    SHA256

    ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

    SHA512

    18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

  • \Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

    Filesize

    816KB

    MD5

    f0da1442a179d4074cfb10acffa66631

    SHA1

    e2fca5d7b810ad9086a23d3db7312112a202e6e9

    SHA256

    ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

    SHA512

    18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

  • memory/1708-16-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/1708-14-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/1708-17-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/1892-0-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/1892-2-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/1892-13-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

  • memory/1892-11-0x0000000001FF0000-0x000000000219D000-memory.dmp

    Filesize

    1.7MB