Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 11:47

General

  • Target

    89b48c2d597f74bbfeb9bcb3df410a81.exe

  • Size

    757KB

  • MD5

    89b48c2d597f74bbfeb9bcb3df410a81

  • SHA1

    4a1ff552926f5caf1892a2c96fa4fd0e1fb5fbf5

  • SHA256

    a7ac72fffdad0067658b52af3ad260c0b41b9e20876230743910b8715a74ea48

  • SHA512

    cb5a41b98b6715dedd633c18e8746e8fa336bbd125f58494e9501eab1506aced698ab647d569945e3450a87c7bb31c84511089a846dcd31b0e6c6e21a76ff01e

  • SSDEEP

    12288:VQi3O2gsv6m6URA3Phkzp1hf39Wkv8xwJC/:VQie2BChhgpdUMC/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe
    "C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\is-BBCJM.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BBCJM.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp" /SL5="$7011E,506086,422400,C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-BBCJM.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp

    Filesize

    1.0MB

    MD5

    090544331456bfb5de954f30519826f0

    SHA1

    8d0e1fa2d96e593f7f4318fa9e355c852b5b1fd4

    SHA256

    b32cbc6b83581d4dc39aa7106e983e693c5df0e0a28f146f0a37bc0c23442047

    SHA512

    03d5cbc044da526c8b6269a9122437b8d386530900e2b8452e4cf7b3d36fc895696cbe665e650a9afbdec4bad64a3dc0f6f5e1309e07f6f1407ec0643cac121d

  • \Users\Admin\AppData\Local\Temp\is-HV4TD.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-HV4TD.tmp\idp.dll

    Filesize

    216KB

    MD5

    8f995688085bced38ba7795f60a5e1d3

    SHA1

    5b1ad67a149c05c50d6e388527af5c8a0af4343a

    SHA256

    203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

    SHA512

    043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

  • memory/2208-1-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2208-24-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/2260-8-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2260-22-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB