Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:49

General

  • Target

    0946cc7f6064d14c01e53002e1ac80a6.exe

  • Size

    124KB

  • MD5

    0946cc7f6064d14c01e53002e1ac80a6

  • SHA1

    a47aacee717bc1f22c1d7b24fe09866a7d5242fe

  • SHA256

    3f6a7cbf6437d41f9c00442c9cd7dd8d40c39054b11521b4bee0006d63ad4c92

  • SHA512

    5a5b1735322541bcac464cadf83615d4934ec15924e24bd262e248b889470c2e71d0c5bd573a204d5cd0391d5b9885997f46327f39ac49cae7431daaa86cb018

  • SSDEEP

    1536:hUE6hwRzuBxeDtMYHa27J14ltxporZ45izNeG0h/x:yE6hwRzkeV6gJ1uCt45Jp

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0946cc7f6064d14c01e53002e1ac80a6.exe
    "C:\Users\Admin\AppData\Local\Temp\0946cc7f6064d14c01e53002e1ac80a6.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\xuuhaeg.exe
      "C:\Users\Admin\xuuhaeg.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\xuuhaeg.exe

    Filesize

    92KB

    MD5

    c3d9cd84ae65209f075968bd57b5f19d

    SHA1

    ba2212188753d05d548803ef1c7c31aefa07781d

    SHA256

    08dbaca64bfa0b93ac745560131101e7f0b3bdc53c4f757cdc71b1170cf6b919

    SHA512

    db712fa9320415a3861950dfbc6d878331ddb71d0af929535f1eafa7b3d2af1f772fae23382260a4ce3cc57b98abf5593ed2b8bd18dd04fbb67785ce3befc323

  • \Users\Admin\xuuhaeg.exe

    Filesize

    102KB

    MD5

    ed0d116561ebfbddb497e2b427989bd5

    SHA1

    3ae26c623da1c391c044f05f6a65fa0e4405bd3b

    SHA256

    2e61276582805ead2e5927a4def456717ab5b334bdb5b3d04a3eebc7631be384

    SHA512

    1900e841b63e8d985aef35fa47efa84eac6a091ec3d78269502b18ddc79f419ff4376335d645ae87821300b726fdd05ae77447fe2f981baa6cb87c70394e0db3