Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 06:50

General

  • Target

    0cc6e26d7df15fe7a6329cc7a6e779af.exe

  • Size

    1.1MB

  • MD5

    0cc6e26d7df15fe7a6329cc7a6e779af

  • SHA1

    9133752b9a38ed91f213944142754e973320035b

  • SHA256

    10556d6afa03b09ee9d29bd0f8f1974dc77a5a8ada19edef155ca454a3c6e430

  • SHA512

    2042de12dd8ca65eb67045761f2041003c9da3b6d4129f67cf8208476029b3d89e2a35bc4b30454a9cec79488e690e765fdd758b9ce6f2749c0012b70c5e09f7

  • SSDEEP

    24576:TWvknOMEfSwcbBxox2LJm8ezsdZu2qtoD2GpD7CcA+A:TUeOMm5mcEk8eIkwTA+A

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cc6e26d7df15fe7a6329cc7a6e779af.exe
    "C:\Users\Admin\AppData\Local\Temp\0cc6e26d7df15fe7a6329cc7a6e779af.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\a2ZUlhA1pc\rdAZRrDD\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\a2ZUlhA1pc\rdAZRrDD\Setup.exe --relaunch
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a2ZUlhA1pc\rdAZRrDD\Setup.exe

    Filesize

    33KB

    MD5

    7d77f36860a3813da92466f7e70188fd

    SHA1

    c5e209d91efa135d693bb4cbe3261073623de5b4

    SHA256

    15eb5ac39f1cdeca4f2d86f41537e79e7d0112c03a803d3dee5d103bc3f9c4bb

    SHA512

    20d653782945f336a8b29f3712b2498c2c3fa12069e4247485b88c9be8a78cf800cac454c9ee31247adc7b81df8e301a2c52beee3b5a2b6698eb4e8467dfa3fa

  • \Users\Admin\AppData\Local\Temp\a2ZUlhA1pc\rdAZRrDD\Setup.exe

    Filesize

    1KB

    MD5

    61e5f79e37611022e8eb6574ffdb0227

    SHA1

    ce6c4051bff9195ce035d2067c8c89c7e81ef08c

    SHA256

    d9b90f5e012ecc13d5a45936a8585ff04ed81cc034cf1c8d6a6daa4747bb6c74

    SHA512

    9b781f0fcca371bb1d42aec0e76e882a8f5bf0364b3fded9933f90069aad97aa2e690c4604ec925d5a6523d2442e5f124db9a4193464f1a7408af3a0c850a036

  • \Users\Admin\AppData\Local\Temp\a2ZUlhA1pc\rdAZRrDD\Setup.exe

    Filesize

    107KB

    MD5

    5ec6659f37a12fa861c72ee37c3bfcd0

    SHA1

    c950a0ac1a6602daf3894528f88bf1781315a41b

    SHA256

    802312490a8f75b4b6ed07e2a0b1041770e87a7223d807c9f8ffdc53fbbbe0e0

    SHA512

    2a76983cae2d2b27ba9112e4c99c0a88a7d7a5235bd129f7e36ace3017b02f917c00c72267e7a1ff1ced2790df0185f6baaa3002d760d67cc88d08ecfeb33dc2

  • \Users\Admin\AppData\Local\Temp\a2ZUlhA1pc\rdAZRrDD\Setup.exe

    Filesize

    6KB

    MD5

    6c305a075c527fea55fbd4bcbf437aed

    SHA1

    c22b16e06d04e57385a33b9ef06a35792d0bfa1e

    SHA256

    ca734c2c2dcd38782c8cf3f4b7235a60b612b51c64ba8ef84592c217a44fca1a

    SHA512

    6b61899fb0c53552f408ac340a7526e0ff1811d9e9f4f292c22d0aae73d2e39d00d2e7803c86c032c7d746b3d3315e9e31c3cab2dcfb636da0ef9ae3eb0d20fe

  • \Users\Admin\AppData\Local\Temp\a2ZUlhA1pc\rdAZRrDD\Setup.exe

    Filesize

    9KB

    MD5

    b553cac001f13a44d8813f5c6c08e56d

    SHA1

    f845b8006ca44881022d721617d351207107bad8

    SHA256

    d4a928469770fb5fea8c4075065ed4f2d29cd2887fc803da21bef0f5f9190ccd

    SHA512

    95f0a2f86abd1902fd453a57495c7e13d3b04667101b291f44b9e63c2e582b5b42933a3a5092a068fe33aee199a28ce04988c5c400a23b4cfb862441bf675905

  • memory/2104-843-0x0000000002080000-0x000000000217E000-memory.dmp

    Filesize

    1016KB

  • memory/2104-624-0x0000000002080000-0x000000000217E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-40-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-49-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-48-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-10-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-8-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-11-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-12-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-13-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-14-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-16-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-17-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-18-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-19-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-15-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-20-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-21-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-23-0x0000000077300000-0x0000000077410000-memory.dmp

    Filesize

    1.1MB

  • memory/3068-22-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-25-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-24-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-26-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-28-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-31-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-33-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-35-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-37-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-39-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-38-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-36-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-2-0x0000000000400000-0x000000000051EB14-memory.dmp

    Filesize

    1.1MB

  • memory/3068-42-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-43-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-9-0x0000000000400000-0x000000000051EB14-memory.dmp

    Filesize

    1.1MB

  • memory/3068-7-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-41-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-47-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-46-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-51-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-45-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-44-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-52-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-50-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-34-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-32-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-30-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-29-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-53-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-27-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-54-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-56-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-62-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-66-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-65-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-64-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-63-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-61-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-60-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-1-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-0-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-58-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-59-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-57-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-55-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-203-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-853-0x0000000000290000-0x000000000038E000-memory.dmp

    Filesize

    1016KB

  • memory/3068-852-0x0000000077300000-0x0000000077410000-memory.dmp

    Filesize

    1.1MB