Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 10:03

General

  • Target

    15dd205f125a17ddc29c65e81a2f667d.exe

  • Size

    225KB

  • MD5

    15dd205f125a17ddc29c65e81a2f667d

  • SHA1

    12476f8703f989e62018c371373e5c4039767bfd

  • SHA256

    e329839e331470138383753f30fb6bae48e7688d45c3db583fdf80a68dbc92b7

  • SHA512

    c0890989c7ff4c40f0320e22599317e513f3a0e0285df601a61de1778cf6652d7ebe80eb1c976a28f8bf3e66da08c2183531c97c6267ca02217b40d29d825394

  • SSDEEP

    6144:d8KneNc5QyMXkm9tRSJZb5OhX6CrdfONr:qX7vH1SLbUd6cM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15dd205f125a17ddc29c65e81a2f667d.exe
    "C:\Users\Admin\AppData\Local\Temp\15dd205f125a17ddc29c65e81a2f667d.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\Vfabaa.exe
      C:\Windows\Vfabaa.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job

    Filesize

    344B

    MD5

    56c54ee5a6a8bbdb653668a80a238db2

    SHA1

    399b1858e48697ac1e67b07dac3fb0168c760ae7

    SHA256

    d9c856d1297f2f2b26275d2c67b7f6dd66ba56b4905b582f459b1275fd24e8bd

    SHA512

    7c8470b3c8cfd43e4b8ac80012d96af39c1a71298d1ac842aa00cb58b90bc8610a0d875422e5c3353f4501ec4e67cebd2001710ce475d4a9fbeb9ff89c2c91d0

  • C:\Windows\Vfabaa.exe

    Filesize

    225KB

    MD5

    15dd205f125a17ddc29c65e81a2f667d

    SHA1

    12476f8703f989e62018c371373e5c4039767bfd

    SHA256

    e329839e331470138383753f30fb6bae48e7688d45c3db583fdf80a68dbc92b7

    SHA512

    c0890989c7ff4c40f0320e22599317e513f3a0e0285df601a61de1778cf6652d7ebe80eb1c976a28f8bf3e66da08c2183531c97c6267ca02217b40d29d825394

  • memory/2656-2932-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2656-1-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2656-2-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2656-23317-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2656-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-18293-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-10-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-9-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-29963-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-33767-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-49621-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-53479-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-53480-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-53482-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2716-53486-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB