Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 19:10

General

  • Target

    0153c459dfa933ede22885a57b467cb1.exe

  • Size

    188KB

  • MD5

    0153c459dfa933ede22885a57b467cb1

  • SHA1

    50a1ecaa12fbdeb4ffc7bc37f6b97286f95dee51

  • SHA256

    e48d30d2c781d18c59cb543008c2b1ada45894e4985868e9ba2e2c6e13177a2e

  • SHA512

    f348ea08916715dbaa4a58f37030f4bc76e96b25a2c59b75427aba57ecd9ffc6b06e9098573e20709fdecc9589b46134e3e39d63e7e28afccb678adae5ffeb4f

  • SSDEEP

    3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8dh1j:o68i3odBiTl2+TCU/s1j

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0153c459dfa933ede22885a57b467cb1.exe
    "C:\Users\Admin\AppData\Local\Temp\0153c459dfa933ede22885a57b467cb1.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2900
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\bugMAKER.bat
      2⤵
        PID:2980

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\bugMAKER.bat

      Filesize

      76B

      MD5

      a51c205a20333e1fae90bb3e11d31126

      SHA1

      e9023e392cd0a727dc78504663e425f1c4a1d932

      SHA256

      417ff18e7ab2ac09be38a589253ad15e1705271e18af82323f267567cbc97d7c

      SHA512

      33967c86435b3db10bd598d9fa6ad81dea4f33ac6fa9fa20fbb9ab3f8e00d280a61188ea222370e60c7aa12742f5f37878d9361aeb8851eda4f594264c682147

    • memory/2900-67-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2980-62-0x0000000000800000-0x0000000000801000-memory.dmp

      Filesize

      4KB