Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 13:12

General

  • Target

    20d521c4f349238b69f89b22782aa451.exe

  • Size

    33KB

  • MD5

    20d521c4f349238b69f89b22782aa451

  • SHA1

    c2fd4c7cf07e55e3fde5489e53c67c56ece06bd0

  • SHA256

    8dc945fb22004202a2135696f071a9f242cc4d1185a6e5652de46d3e00ddb824

  • SHA512

    35a4a0b0d02bcee4caf28cd85595bbea4c8dfe21c831ebfc34b3db2bd8fcc3b37cb3e6561829b1ddc8267eeb42ea5971cb279aa24f833bd66c3d8cf087c4ab75

  • SSDEEP

    768:Vcx9urLky4oRaJmnjaad4ATyfBXGvUYGMr2FNbuSK1TLNQKhUJb+M:VnrI6aJYjaa+ATypWsPpud1Hhg+

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\SysWOW64\taskmngr32.exe
    "C:\Windows\system32\taskmngr32.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    PID:1288
  • C:\Users\Admin\AppData\Local\Temp\20d521c4f349238b69f89b22782aa451.exe
    "C:\Users\Admin\AppData\Local\Temp\20d521c4f349238b69f89b22782aa451.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\taskmngr32.exe

    Filesize

    33KB

    MD5

    20d521c4f349238b69f89b22782aa451

    SHA1

    c2fd4c7cf07e55e3fde5489e53c67c56ece06bd0

    SHA256

    8dc945fb22004202a2135696f071a9f242cc4d1185a6e5652de46d3e00ddb824

    SHA512

    35a4a0b0d02bcee4caf28cd85595bbea4c8dfe21c831ebfc34b3db2bd8fcc3b37cb3e6561829b1ddc8267eeb42ea5971cb279aa24f833bd66c3d8cf087c4ab75

  • memory/1288-12-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1288-13-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1288-14-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2532-4-0x0000000002AA0000-0x0000000002AD3000-memory.dmp

    Filesize

    204KB

  • memory/2532-1-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB