Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:15

General

  • Target

    07391365458c2475f1b0362e1e91c9d8.exe

  • Size

    1.0MB

  • MD5

    07391365458c2475f1b0362e1e91c9d8

  • SHA1

    df3c6753baf691a279c13dcbbf74de07821f8920

  • SHA256

    dbaf74e7c1bcc29b8b031fc1a9bdb543af70f0049bc29625f3ffa92282ca0c8f

  • SHA512

    da2a93f601ea6dcd3f80c95ba0e5ae531743efd6531edb2205aa81a6272d11a06a27d59d77c049c05e03df1028a40a20fe7f361e2da5b152d38b4acc97ee5200

  • SSDEEP

    24576:v2UO/CgJ4bsjJgSpHeU1WTwCq7LuQoQihvoui7NNmH6swr:v2GgJOoCyHelC7KEX7NcH6swr

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\is-OGUF2.tmp\07391365458c2475f1b0362e1e91c9d8.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-OGUF2.tmp\07391365458c2475f1b0362e1e91c9d8.tmp" /SL5="$30138,854986,53248,C:\Users\Admin\AppData\Local\Temp\07391365458c2475f1b0362e1e91c9d8.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2524
  • C:\Users\Admin\AppData\Local\Temp\07391365458c2475f1b0362e1e91c9d8.exe
    "C:\Users\Admin\AppData\Local\Temp\07391365458c2475f1b0362e1e91c9d8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-OGUF2.tmp\07391365458c2475f1b0362e1e91c9d8.tmp

    Filesize

    85KB

    MD5

    16b07c42920914e41a5ca89c30bca0a3

    SHA1

    06cc4e8ee7ecff712ca10b230597d987f81555fd

    SHA256

    999f5e99013b73d03e4342ad329af05cdd40da7c0b751d100ff0cb71f6fabf17

    SHA512

    5e2ca0cc72472a01359db4bd845456fd76f9691ebb9736d5ce4693ff89f82a5015d49baca76ea1311b4f66caabe49eaa00446c92334a119ac4fad80dcb6b5492

  • \Users\Admin\AppData\Local\Temp\is-OGUF2.tmp\07391365458c2475f1b0362e1e91c9d8.tmp

    Filesize

    669KB

    MD5

    52950ac9e2b481453082f096120e355a

    SHA1

    159c09db1abcee9114b4f792ffba255c78a6e6c3

    SHA256

    25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

    SHA512

    5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

  • memory/2524-12-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2524-21-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2524-24-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2532-1-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2532-20-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB