Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2023, 23:02

General

  • Target

    8144743b0a64295bfc985e1074aef85835516ff69ed31ba84c064b99da2ed91f.exe

  • Size

    2.4MB

  • MD5

    88aea50f5603d50db0649acedb802494

  • SHA1

    ff9cf8dcf4292f840cd17e4cd83e4c028f3aeb61

  • SHA256

    8144743b0a64295bfc985e1074aef85835516ff69ed31ba84c064b99da2ed91f

  • SHA512

    4d6fb4b936a2e2b4ad6e9fba6387c45cb67deaceeb8400480ec61f06bbb7ff4fbff7d425015c02a0370dc3b4586bcdcc45ae5ac1a5e27daeb073ae8080bcad95

  • SSDEEP

    49152:gHeawhTk/BQ5l72ZfefZ71gpgE0khFu7DRzYu:Aea/pQXe2fZ7GV0SFIb

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8144743b0a64295bfc985e1074aef85835516ff69ed31ba84c064b99da2ed91f.exe
    "C:\Users\Admin\AppData\Local\Temp\8144743b0a64295bfc985e1074aef85835516ff69ed31ba84c064b99da2ed91f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\HPSocket4C.dll

    Filesize

    802KB

    MD5

    ae951314f93ac6252bb271fc79f2fd1f

    SHA1

    b538410d0fa39917690aa749ab2a32fe6dae1750

    SHA256

    fb402e7e4a646e95afb5c37c1a85ea079a246d927557e1e1a6998eec01a136a1

    SHA512

    530f34f71cba40f1bf692d6ffa45a379b140cfe0524e2cb99ed90cf288cb7331a8f0e345db93bf0e33bbe7bebe516fea8693fe6fec9f54b6770c18e4a86be9d9

  • memory/2420-10-0x0000000075650000-0x0000000075750000-memory.dmp

    Filesize

    1024KB

  • memory/2420-2-0x0000000000400000-0x0000000000AC3000-memory.dmp

    Filesize

    6.8MB

  • memory/2420-4-0x0000000010000000-0x0000000010116000-memory.dmp

    Filesize

    1.1MB

  • memory/2420-8-0x0000000002360000-0x00000000023B9000-memory.dmp

    Filesize

    356KB

  • memory/2420-9-0x0000000075650000-0x0000000075750000-memory.dmp

    Filesize

    1024KB

  • memory/2420-0-0x0000000000400000-0x0000000000AC3000-memory.dmp

    Filesize

    6.8MB

  • memory/2420-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2420-17-0x0000000073F50000-0x000000007423C000-memory.dmp

    Filesize

    2.9MB

  • memory/2420-18-0x0000000073F50000-0x000000007423C000-memory.dmp

    Filesize

    2.9MB

  • memory/2420-20-0x0000000075650000-0x0000000075750000-memory.dmp

    Filesize

    1024KB

  • memory/2420-21-0x0000000002360000-0x00000000023B9000-memory.dmp

    Filesize

    356KB

  • memory/2420-22-0x0000000000400000-0x0000000000AC3000-memory.dmp

    Filesize

    6.8MB

  • memory/2420-23-0x0000000073F50000-0x000000007423C000-memory.dmp

    Filesize

    2.9MB