Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2023, 12:45

General

  • Target

    2742d17ba0dff71a546cc9bf99dc3d43.exe

  • Size

    13KB

  • MD5

    2742d17ba0dff71a546cc9bf99dc3d43

  • SHA1

    444955ae2dd65d927a9bccebb9007e8ba0c796db

  • SHA256

    79f2d6b43888e8bac0f0cf84dbfcac4cbbddecd194e624707b74bb54a6aae5ab

  • SHA512

    e81e0b431dfd127abad3beb1355cfd589c694521bc68d7a3d48d8a77b1e066c27da9a384205f734fa0658016921c82ffb63f1c45d9cc1524fe327f7b0667f3a3

  • SSDEEP

    384:fU/JP0nwR2CpfuK3ibpOVYnpQJ5jdstrrTNm4:c/JPSwRNrUQVYnpe9qZrxm4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2742d17ba0dff71a546cc9bf99dc3d43.exe
    "C:\Users\Admin\AppData\Local\Temp\2742d17ba0dff71a546cc9bf99dc3d43.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
      "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6736e4da3d187fc7ef9b60680a497682

    SHA1

    117cdbdb727ebec807f3ef6e0e8d98440443813f

    SHA256

    61a96d5b196a82fd216a29b9e46fa0be38566e8b5be6c8fcc498ea81fa586b3c

    SHA512

    b6a00374fd4a1b080d8979718f52b0a229215954c0252322f53e5944889d14d35063facaea13136acf14aff8d74648f9a1aad51415ba0a2338056a61bad6e65a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    2be4d7d1526b119573994311b76be974

    SHA1

    90598f3e23902d805e74b40763634b552d30f5bd

    SHA256

    c57c950b61ce283690bbec25cca8cf1678b2e6e5b1d287448fb0e5df2316a661

    SHA512

    2f55dfed40d13ba53a2220f0ce77dce9e134366bf8b0aaf31288444520191bc2da3c5bcb1ab20e003162f1acd5535f82516cb5dc76c7240370c3b2759e803e02

  • C:\Users\Admin\AppData\Local\Temp\Tar22B2.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

    Filesize

    13KB

    MD5

    a9e598c919a062a405bab7c694e6ebd4

    SHA1

    1b90384c5ef3f4ed112767fbd40db9674e3c3e85

    SHA256

    4f43f5818f0316f090ee97671c17fcb8903ceed99f95bad820937d9992297f10

    SHA512

    22130d4014a92eaf2cc356069c3a129f68b440f087e352c5f7c6a65ccb910947cc4430a28601b8267ef3140f0c56196ca676e0674e23b82b5a8608304e5abca3