Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 20:32 UTC

General

  • Target

    f6285b13569db39145cec203eb06b31d.exe

  • Size

    20KB

  • MD5

    f6285b13569db39145cec203eb06b31d

  • SHA1

    63ddcb05148d43899bc61b4ee8649a70e64a29c7

  • SHA256

    e4f27133eef95be9ef1c3aef873ae50ee19166bfab5fd86c34a16572875c76aa

  • SHA512

    e30447177e46b8cd2570bfb615ca0eaa6e3a7f7210c5fe2448cfdabd6bfd78c7c1087b4b2d667b4c969d4917925bd2fe6cb48063dc318bee9cc12ccb8d90da19

  • SSDEEP

    384:7LZPnqGM39DCDYgjSc6fJqgG61qv0Wq5vudIeYJFinATam9xO:Vr+w0BfEg5qv0W2Xinlm9xO

Score
6/10

Malware Config

Signatures

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6285b13569db39145cec203eb06b31d.exe
    "C:\Users\Admin\AppData\Local\Temp\f6285b13569db39145cec203eb06b31d.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious behavior: RenamesItself
    PID:2204

Network

  • flag-us
    DNS
    rdm-gool.net
    f6285b13569db39145cec203eb06b31d.exe
    Remote address:
    8.8.8.8:53
    Request
    rdm-gool.net
    IN A
    Response
No results found
  • 8.8.8.8:53
    rdm-gool.net
    dns
    f6285b13569db39145cec203eb06b31d.exe
    58 B
    131 B
    1
    1

    DNS Request

    rdm-gool.net

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2204-2-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.