Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 20:58

General

  • Target

    f7c31f9bbf574bc22b058cc67ad503f9.exe

  • Size

    908KB

  • MD5

    f7c31f9bbf574bc22b058cc67ad503f9

  • SHA1

    1581e7f3b778303068451d1eaa3e309fdd9d188b

  • SHA256

    f619484090ebbe96ee99eac61b5ba76acf3063a114b5ff1d8f1464ef98553adf

  • SHA512

    6bacd170f5ac04617df5466677ef13963a7db4c0e5196a3716c789fc4b3cbb0b24c5a4262a52d6836fb30940fcaf419364cc1bcf309c9c9f51bcf79a9f05c366

  • SSDEEP

    24576:8/NiRWfP4WOfJ/418E3X4ur1FYM0/5b3MomTlZx:uYUtOfJFE3X4urY5hAoY7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7c31f9bbf574bc22b058cc67ad503f9.exe
    "C:\Users\Admin\AppData\Local\Temp\f7c31f9bbf574bc22b058cc67ad503f9.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\nzy4linWjhqSjOVfKdCq.exe
      "C:\Windows\nzy4linWjhqSjOVfKdCq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 552
        3⤵
        • Program crash
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\nzy4linWjhqSjOVfKdCq.exe

    Filesize

    4KB

    MD5

    ffe738fec012a4d42fb4ed93a308bcf2

    SHA1

    dd7ce6830f28f867e615c2c245b03daa26f47aa3

    SHA256

    9451b95d4eedd1970aad2f6d28e52f566b954e23e1c2d2647a3832b31261565d

    SHA512

    8e51aec890aead09276bb511a7cc46aae2d262a0f3553815e5839fb4657d9b67b30f8c6dc65e0304095f45365ed980f12c9ebd5bd0c581630c53a972ebf0f15b

  • memory/2688-15-0x00000000721F0000-0x00000000728DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-14-0x0000000000E30000-0x0000000000F1E000-memory.dmp

    Filesize

    952KB

  • memory/2688-16-0x00000000049B0000-0x00000000049F0000-memory.dmp

    Filesize

    256KB

  • memory/2688-17-0x0000000000350000-0x000000000036C000-memory.dmp

    Filesize

    112KB

  • memory/2688-18-0x00000000721F0000-0x00000000728DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-19-0x00000000049B0000-0x00000000049F0000-memory.dmp

    Filesize

    256KB

  • memory/3028-0-0x00000000742D0000-0x000000007487B000-memory.dmp

    Filesize

    5.7MB

  • memory/3028-1-0x00000000742D0000-0x000000007487B000-memory.dmp

    Filesize

    5.7MB

  • memory/3028-2-0x0000000000120000-0x0000000000160000-memory.dmp

    Filesize

    256KB

  • memory/3028-13-0x00000000742D0000-0x000000007487B000-memory.dmp

    Filesize

    5.7MB