Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 02:53

General

  • Target

    56f34b3ab700e04ec7c3e8c7bc78dd3d.exe

  • Size

    987KB

  • MD5

    56f34b3ab700e04ec7c3e8c7bc78dd3d

  • SHA1

    fc45745fe582d9229354855686bb05156b1d4bba

  • SHA256

    725b6df7934f8e1f7503766960a763653f02209d135b3728f89f243dcbf9ccbf

  • SHA512

    1118f937bcbeece8f6eb738af6331c3eea37736b40061f7e64198ea0781ba4e939b91ebff8083d578b4575e93707cd70c9659ca7ae592830902f66e0e17c58b0

  • SSDEEP

    24576:dgdhhQGGniba/WPpuvlBEaneHueYQFSMVNS/:dqj5s8+elYQFSM7u

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
    "C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Program Files (x86)\utsiawm\vpb.exe
      "C:\Program Files (x86)\utsiawm\vpb.exe"
      2⤵
      • Executes dropped EXE
      PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files (x86)\utsiawm\vpb.exe

    Filesize

    999KB

    MD5

    a30dafd9850bca6816617a75f1a7ecc1

    SHA1

    3885166318dcec81992686775828c30c95ed374e

    SHA256

    c3c568038a45a3ae50f1f736d116ec14a2ebfb40b22682629ef8438ddf3d6a78

    SHA512

    cb932102ad0f374206dd6a41ff77949d3ab0d30fd0f2fdb137c9beedcbdd4c3abe507a1a150ed938909709d54fce8c010d7b1564844f9e652a6c798869f73bc0

  • memory/1796-6-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1948-5-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB