Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 19:09

General

  • Target

    0146d7298802931da9acb5b0050d0063.exe

  • Size

    82KB

  • MD5

    0146d7298802931da9acb5b0050d0063

  • SHA1

    7f092530609baa416e263bd78509cf4f2059605b

  • SHA256

    a12d0cf8f8cd5c2abdda31b33f1a967e993b2976c5635461314917a279a01a86

  • SHA512

    46925d7ea72f37b8dadab45c6681335d56bd7ff108e717a37252b8b6d24017ab97bccb27b9f7357a6593840af50458791cd9084f68065b9009d14f2f73379b80

  • SSDEEP

    1536:dIZvSK6RxOPPD+XgHcISECbcoZow+8LWqqJDXtxvgRzdNTq3Wy+3:2gFOCZEEc1w+nZJ7Py3P

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe
    "C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe
      C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe

    Filesize

    82KB

    MD5

    0d4ac82ba5af2d5093a86867f8ce9f05

    SHA1

    d7ac641130e336e224c1e653769f4c3c5b885c7e

    SHA256

    1def3a0a4117dd25d9c4a0769d254751bda0ef75e3e3882819e856f584bd9aee

    SHA512

    f71d0b650a115481b6e2d651ba62b151b9f432deaab0feb193e6b18f72c039cd6a6cdd1af77123e7a499b8abb814ed36810d34f1b82cd6bcb35518d6c42edcd4

  • memory/2120-19-0x0000000000140000-0x000000000016F000-memory.dmp

    Filesize

    188KB

  • memory/2120-28-0x00000000001A0000-0x00000000001BB000-memory.dmp

    Filesize

    108KB

  • memory/2120-23-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2120-18-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3024-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3024-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3024-14-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3024-1-0x0000000000140000-0x000000000016F000-memory.dmp

    Filesize

    188KB