Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 02:26

General

  • Target

    4ca21c6bd97b1f0edddd4125c19959c8.exe

  • Size

    1.2MB

  • MD5

    4ca21c6bd97b1f0edddd4125c19959c8

  • SHA1

    3fe62770dd1bd441d7de3e9597c78e96b1913191

  • SHA256

    33c0598a4f25546b028a22bbb0238c9d788f9625207ecd546ea55abfe7670982

  • SHA512

    1e5ea1993ffe9715798cfe6e75cd15bd274ce15c31d44ac8c79aaaa281fadec32f8cc94cbbb0239cacd322d0b8dce3c1e9471fc5b2bd4f4482635bc837a3238c

  • SSDEEP

    24576:VfOydJf48pgJef/deObHp77RL6qupeWpw6Dx5xlp2uRcYdDBKVYHZkgcAuMze4:VGMJf46fFhbHpAXpbW6V5xlp5RcYTTZJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe
    "C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\is-T3G5D.tmp\is-Q6OA6.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-T3G5D.tmp\is-Q6OA6.tmp" /SL4 $30150 "C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe" 1014406 51200
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-2EJMP.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-T3G5D.tmp\is-Q6OA6.tmp

    Filesize

    652KB

    MD5

    46570158ccae518dcf05602fea3e1bd8

    SHA1

    c71f09e0a4fcf9061fe8de67defb569361ed90b0

    SHA256

    eb289ef14e8f3b47081e1168690d1d95185dbfd1c3cdc5bfb074fd76a42cead0

    SHA512

    2721915717efd108cae39326d3644ecb55d1c47586e280b3f04f1b7f6a799ad9c0daaa3a410e667eaf7bed0265c9fee54cb899424d0935c2e6ab6ed896d29f97

  • memory/2180-8-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2180-17-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2180-20-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2484-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2484-16-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB