Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 05:05

General

  • Target

    569335ab90141b8fff29c9f84a5535eb.exe

  • Size

    94KB

  • MD5

    569335ab90141b8fff29c9f84a5535eb

  • SHA1

    8cc615007cc127d385b55b0360c34549423f86b9

  • SHA256

    587e83ddfc378176004ecddc8751733e32776c0567e701402b83e681ed2c290b

  • SHA512

    3f90c0feca85815ca2599c671802ba2fbb2a349e404fd0667a90ad871df0facbf134e9085edda9e39e9cd17075ccd65bb5c201c99e14f3aa7bd1ba4acab03645

  • SSDEEP

    1536:vfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:vfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\569335ab90141b8fff29c9f84a5535eb.exe
    "C:\Users\Admin\AppData\Local\Temp\569335ab90141b8fff29c9f84a5535eb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Hlj..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Hlj..bat

    Filesize

    210B

    MD5

    2f86f88a05b22f446d33b23c1ea045a4

    SHA1

    2965774f1d8ff5a20666ef0e272348b035fa05b8

    SHA256

    a49bc0b7f43a51a9c21af9ea8899f96cfaa06cfcf619f3ce0a13494667c21e43

    SHA512

    da1c91bdbc97f05296f5d81e9292c2f7479793febc05d4660b1a20d35e88265fbae35ee7c01d14105c122bd6a9a55b813d7d054affbc1446ffca3f37e2f781a6

  • memory/1708-2-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1708-1-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1708-0-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1708-3-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1708-5-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB