Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 01:58

General

  • Target

    0ae6a67be9ebfc240ddbfacfbed8fea7.exe

  • Size

    1.5MB

  • MD5

    0ae6a67be9ebfc240ddbfacfbed8fea7

  • SHA1

    19dee10961a4669477892224d4a70f806876fcee

  • SHA256

    23d0ec54bc45fde229f0435aeea2c75c4ecd92e3b174b5efd43d3f62749c8ba1

  • SHA512

    de9c6184966c6162918cdae1792107dc9576b93975540dc00f113fb6324cfc472f85593d43d07b5b5ad8fdef420bd95fcb4c9d815e899c46bace544c84d3cd49

  • SSDEEP

    24576:e9dG37Vk0R07Qanm9+XA9Jp8GnT26JSG5UEdPDeswt1T/LLTYwazt:lrq0R07QQmiA9cciG6E613VaZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe
    "C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\CC.tmp
      "C:\Users\Admin\AppData\Local\Temp\CC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe 185F875790108BE56B51415C51ABC9F40AB968BEDBC847A5229FA17432C1BCAE8A81179C49652098F0FC4838E3281E864919EE00F5B55D9F134F6F5FD0DD8CE7
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2204-0-0x00000000002B0000-0x000000000032A000-memory.dmp

    Filesize

    488KB

  • memory/2204-1-0x0000000000F20000-0x00000000010EE000-memory.dmp

    Filesize

    1.8MB

  • memory/2316-8-0x0000000000C10000-0x0000000000DDE000-memory.dmp

    Filesize

    1.8MB