Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 19:25

General

  • Target

    0d53e6444bb764478f3d0c894604f2eb.exe

  • Size

    62KB

  • MD5

    0d53e6444bb764478f3d0c894604f2eb

  • SHA1

    71b5e47d1c6e8e188f81b35aa0ef7a247455d4e2

  • SHA256

    eb0b58a0ec2ae65ac9494bdfe5df965a26a5a72e1f79da4d3367079ed8898e41

  • SHA512

    4af5030746eeac809f95fdc5c93da23ced4aff921c8f08e3b883a174d03a91d44ea872b3862aa1fe06232dcc143f75b8efc50ef96b8cf67179af0051589ee392

  • SSDEEP

    1536:2gkoOTi5HfgygwDOvCyFWLp27HzPVjnBwX3yl:2QZh3gwqvVWU7TQHyl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
    C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
      C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1460
  • C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
    C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Windows\msupdatemanagerneweditions.exe
      "C:\Windows\msupdatemanagerneweditions.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\msupdatemanagerneweditions.exe
        C:\Windows\msupdatemanagerneweditions.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\msupdatemanagerneweditions.exe
          C:\Windows\msupdatemanagerneweditions.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2008
          • C:\Windows\msupdatemanagerneweditions.exe
            C:\Windows\msupdatemanagerneweditions.exe
            5⤵
            • Executes dropped EXE
            PID:1692
  • C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe
    "C:\Users\Admin\AppData\Local\Temp\0d53e6444bb764478f3d0c894604f2eb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\msupdatemanagerneweditions.exe

    Filesize

    62KB

    MD5

    0d53e6444bb764478f3d0c894604f2eb

    SHA1

    71b5e47d1c6e8e188f81b35aa0ef7a247455d4e2

    SHA256

    eb0b58a0ec2ae65ac9494bdfe5df965a26a5a72e1f79da4d3367079ed8898e41

    SHA512

    4af5030746eeac809f95fdc5c93da23ced4aff921c8f08e3b883a174d03a91d44ea872b3862aa1fe06232dcc143f75b8efc50ef96b8cf67179af0051589ee392

  • memory/1220-2-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1220-0-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1220-4-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1220-22-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1220-6-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1220-8-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1220-10-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1220-12-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1460-33-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-21-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-15-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-19-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-28-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-24-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-17-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-13-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1460-40-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1692-109-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2008-106-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2008-91-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2724-31-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-29-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-36-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-44-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-45-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-39-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-89-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-34-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-38-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2724-43-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB