Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 04:55

General

  • Target

    55e21a402b17703ca044dc585b0d5d2a.exe

  • Size

    471KB

  • MD5

    55e21a402b17703ca044dc585b0d5d2a

  • SHA1

    e03eedeed893fd870288a100d759c6c76acd2189

  • SHA256

    2111187e6d195d1aec69079bba27790277af6c89b74c3c5a25c4c6d5091eb7f8

  • SHA512

    3d4662e1774ad65966f461e7161805b2945e19472b59cb6ddfa9460fb7c2b1a4a2e22dc4ce2e83eceee764236a50ee62756fe009fc885252a5e3738d61ab3e2f

  • SSDEEP

    6144:9msyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XjYT1:ppO3StxwGc2c3tfmfsCRA22+m+8I1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55e21a402b17703ca044dc585b0d5d2a.exe
    "C:\Users\Admin\AppData\Local\Temp\55e21a402b17703ca044dc585b0d5d2a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\DM\worker.exe
      "C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"
      2⤵
      • Executes dropped EXE
      PID:3004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\worker.exe

    Filesize

    19KB

    MD5

    2b23c69b68708c14fc214c3454e6b1bd

    SHA1

    5c923d25c14ad13dab4f05bb1423026f873e7dc4

    SHA256

    b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd

    SHA512

    00135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5

  • memory/3004-7-0x0000000000D80000-0x0000000000DC4000-memory.dmp

    Filesize

    272KB

  • memory/3004-9-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-8-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

    Filesize

    9.6MB

  • memory/3004-10-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

    Filesize

    9.6MB

  • memory/3004-12-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-11-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-14-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-13-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-21-0x00000000215D0000-0x0000000021D76000-memory.dmp

    Filesize

    7.6MB

  • memory/3004-26-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-27-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

    Filesize

    9.6MB

  • memory/3004-28-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-29-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

    Filesize

    9.6MB

  • memory/3004-30-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB

  • memory/3004-31-0x0000000000B00000-0x0000000000B80000-memory.dmp

    Filesize

    512KB