Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 06:48

General

  • Target

    116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe

  • Size

    92KB

  • MD5

    116f2b637ed8c7b8a9a02fe6d7d9bdc3

  • SHA1

    fb7468b2a8927e969e5cf863c30957dba64939ac

  • SHA256

    0b5eb8c030fe2f8bc28bf320dbbb2f88ee9ed52c1f9f8f3df1d36509e8c560bf

  • SHA512

    f9c28e9d766b0f94d0523fd0bafa83e9c32dbba979e125360f571895098810584204b7e49d5377eb5fd2a55080c41939cebb27b2758ffcbaacac4525c68d7843

  • SSDEEP

    1536:SnZyoJ61G+K31783LU4fXWi8K1Sjzg+LIBjmNv1xZiRhzPh:S8oJ6Gj87UEXWi8K6g+sZ6fCzPh

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe
    "C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe
      C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe

    Filesize

    92KB

    MD5

    428c1027461c02950306d02b80eb9df2

    SHA1

    25dc173682f7685f9b9eaecb657ca04ba6ca2b01

    SHA256

    cecbb72fb3e96d3dd5a3b3e2e2d2684b1ce8b1fe52a2d4e93d23d4d9cbb52c9e

    SHA512

    3bb8185d0466b5abafad3aa8a40851721b648a4b1dccff80eeff15ade66e3692fe135f4105c624aa1eb22595e74778a160dc98065d6f30a0b8521d23a6001a49

  • memory/2560-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2560-2-0x0000000000140000-0x000000000016F000-memory.dmp

    Filesize

    188KB

  • memory/2560-1-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2560-12-0x0000000000210000-0x000000000023F000-memory.dmp

    Filesize

    188KB

  • memory/2560-15-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3004-22-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3004-27-0x0000000000140000-0x000000000016F000-memory.dmp

    Filesize

    188KB

  • memory/3004-28-0x00000000001B0000-0x00000000001CB000-memory.dmp

    Filesize

    108KB