Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 20:37

General

  • Target

    115a403a52dfae29a5d7b5057cc6270e.exe

  • Size

    115KB

  • MD5

    115a403a52dfae29a5d7b5057cc6270e

  • SHA1

    c13ca5b70499a8434c4f5a6a51564a4ec912dfbe

  • SHA256

    0faf9f0416075dd9852ab4e2889830ede7a97fbc6bc2bc1f1ab3f71b8bb51989

  • SHA512

    bf7c382b3ed1881ae626b23505e8d1cecbfe2c48ccc6e32a08d1d85a39e6b12d0d33ea7e0830a47ff59398a4f25d5e21812166052a24408477415f96707a93ed

  • SSDEEP

    3072:YmpEp9xUWu1gGjXr2vwvEbMps2i/XHCob:YmpPTj7QIpsPZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\115a403a52dfae29a5d7b5057cc6270e.exe
    "C:\Users\Admin\AppData\Local\Temp\115a403a52dfae29a5d7b5057cc6270e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Qqz..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Qqz..bat

    Filesize

    210B

    MD5

    28387d644cb3963998b61b4f9ce3b6dc

    SHA1

    448541b115b1c5110a370cb3820a291f3ac82090

    SHA256

    9ebf60f9392869c9131e267abf257d0888228b36cb57b81c687a6df32b622b80

    SHA512

    40d811d6a522c3ccef31615ba6eef7dca5d09608ea259e40eeab3fbac8e8bef044295f4c95859c65605dd1a6590f4bbcf38851c63c6945c033befac62015dc06

  • memory/2168-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2168-1-0x0000000000120000-0x0000000000138000-memory.dmp

    Filesize

    96KB

  • memory/2168-2-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2168-4-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB