Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 09:33

General

  • Target

    14965113e96487385b7fb8e92589d53c.exe

  • Size

    240KB

  • MD5

    14965113e96487385b7fb8e92589d53c

  • SHA1

    67ea22147dbdbe345e337f14668ecbfe0a8307ec

  • SHA256

    1e4e8b73abbf3ab007aa94ad571953169d5d5dca375ee67e53660b182e3be7b5

  • SHA512

    c63ea867b2199ff3861a0765e279952b923655c2bcac6bb5d114b8e6bbe6304e5041fd1c1c98213094d6b265d8aaeefa42a31996b80663362cfd1e7d4212551d

  • SSDEEP

    3072:r6JoB8eFF+YupJ904AX+ipuvnHMC6Fz2Pa9VZumXYdVL63fZi8KGc333ygop+:ccFFk/at6PMFKa9VUuYdVL63fZNMF1

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14965113e96487385b7fb8e92589d53c.exe
    "C:\Users\Admin\AppData\Local\Temp\14965113e96487385b7fb8e92589d53c.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Users\Admin\raius.exe
      "C:\Users\Admin\raius.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\raius.exe

    Filesize

    240KB

    MD5

    7f8aee171512344d5b0b060b90e1fb51

    SHA1

    0b3f948dbf1fb58c8da9675ecc91acd90e15d982

    SHA256

    cb0b03f9ccedf016388ddd5ab9409c3f8a559d4b2191da8e585ac248adedc405

    SHA512

    59138a2c410079718906d8fc3868239e6c6fdc4cb529267fb67e41f1e1738f944357fd859bb9f8ff315c2f8a9015197c050e7b00faa8fa852f69ba5d67e05233