Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

1731951de2...38.exe

windows7-x64

7

1731951de2...38.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 22:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1731951de2fc83f47a9e066df2f40d38.exe

  • Size

    1.5MB

  • MD5

    1731951de2fc83f47a9e066df2f40d38

  • SHA1

    529a755044dee0a498fbee0922d56eb4ee96be70

  • SHA256

    b88d7d8c53bb43c130017bcaaa9934a43cdf6b98cc4b49ded6b3968560ae52c2

  • SHA512

    acf7a6345c82338cf649ea8c207680579d938c16093efd3aa6a3ef45a1ed6a5c9168eab2fdf34dbc901bc1c13b6196d789a2522ee067850aac4e7645f9a671fd

  • SSDEEP

    49152:lrq0R07QQm0XvdZzmULaRHA/deViynVOlJIt:hq0+7DXFNmDRpViyVOwt

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1731951de2fc83f47a9e066df2f40d38.exe
    "C:\Users\Admin\AppData\Local\Temp\1731951de2fc83f47a9e066df2f40d38.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Users\Admin\AppData\Local\Temp\10D2.tmp
      "C:\Users\Admin\AppData\Local\Temp\10D2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\1731951de2fc83f47a9e066df2f40d38.exe 7CD11AC6962CD564552DCAED6F5F014DE31C074A4DD9F0579D949FE309F51B1DD83662545C7BA34B2A0E2AD18AACCD05520672B39251F58F3284ABCFC5532ABD
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\10D2.tmp
    Filesize

    1.5MB

    MD5

    66bb3bc1f3429b3022aa818ebd7701c4

    SHA1

    bb844882114e83741feac137fe5e3ceb6c0b8372

    SHA256

    0b0de45ebf534b318110ab704d8eff7580b44628416df5b3b6f674c09aced106

    SHA512

    d15774e7a35905116ee7523e6501eaee0fb371fef6355ddaa36de9a91ba2124aef1deb927c9b23e7f6199a0e5ac1a2900e25f3485f526833a4ea2389287c6431

    Download Submit

  • \Users\Admin\AppData\Local\Temp\10D2.tmp
    Filesize

    1024KB

    MD5

    fba9332efd195647601afb07bdc9bd50

    SHA1

    7353b92b3fe817482fc531d8ba5ca16066fb1bed

    SHA256

    dbadaf2bbf32da9a1c9725bbab9447362b8d258315feaaebf3c5478ca3700a54

    SHA512

    08c40beeb6486314fc2a813404c58f470da631a11309d27ce3b359ad26a749a8fca046cea25960e09fc5cb86a7a8e9929892ac7d2200c548122b227acb127b02

    Download Submit

  • memory/1764-1-0x0000000000250000-0x00000000002CA000-memory.dmp

    Filesize

    488KB

    Download

  • memory/1764-0-0x0000000000F70000-0x000000000113E000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/1764-8-0x0000000000250000-0x00000000002CA000-memory.dmp

    Filesize

    488KB

    Download

  • memory/3000-10-0x00000000002D0000-0x000000000034A000-memory.dmp

    Filesize

    488KB

    Download

  • memory/3000-9-0x0000000001370000-0x000000000153E000-memory.dmp

    Filesize

    1.8MB

    Download