Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 08:08

General

  • Target

    130401c7bd47fd5772fe61ee7e37199a.exe

  • Size

    209KB

  • MD5

    130401c7bd47fd5772fe61ee7e37199a

  • SHA1

    d3d4c6f8c16403ea0cafd0857ca51579a5d764f1

  • SHA256

    8392e8ebc86eb5bebab49ea05619f7f52f350224d7d308e34be7d818aa85981c

  • SHA512

    07b6c451f1ebe41671ba3369bf4622cab20de6591c547fd59862a6f557f60fc12f5a6f2051713ce92439c5b23ccdea0ce293af1dfcd43e063329c1c6ff53e77b

  • SSDEEP

    6144:VltGmukwuqEBv9KgZI4Szs66U4e8lVkw2AnhW1Hg:NGmN1Z9uzsKF8f6n1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe
    "C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\1008.tmp\vir.bat""
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\SysWOW64\calc.exe
        CALC.EXE
        3⤵
          PID:2440
        • C:\Users\Admin\AppData\Local\Temp\u.dll
          u.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2832
    • C:\Users\Admin\AppData\Local\Temp\u.dll
      u.dll -bat vir.bat -save 130401c7bd47fd5772fe61ee7e37199a.exe.com -include s.dll -overwrite -nodelete
      1⤵
      • Executes dropped EXE
      PID:1788
    • C:\Users\Admin\AppData\Local\Temp\2BF0.tmp\mpress.exe
      "C:\Users\Admin\AppData\Local\Temp\2BF0.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe2BF1.tmp"
      1⤵
      • Executes dropped EXE
      PID:2572

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1008.tmp\vir.bat

      Filesize

      1KB

      MD5

      f4720d714f192b79325554ae2bd89910

      SHA1

      bf53cdb9960e0a9ff3ee202b87853c7534423eb0

      SHA256

      90a2c39393b94e6490207859fe3be74fe0c2e530afcc11531ff777ed2c0d08e7

      SHA512

      c6739943b9280b5040dfae3703cdf21fef1ca583b8525d68337647b4ae579fa1df7fa38357af0c7c5eee0f4b375287e1378b304efe72bf79a25a89fc5b245ddb

    • \Users\Admin\AppData\Local\Temp\u.dll

      Filesize

      92KB

      MD5

      3ead3d1666a7ba5496ca7f0bdba490e6

      SHA1

      1c2707e1ed0b80eceb9e222e7c12e922e1ad1a13

      SHA256

      9c86a7b9cbd93a18253b5101b8a4272f9396e752177b5a49520384df06f18f5d

      SHA512

      147d684c5f73aa2aadc05c01c9aa31e887242edf53b97f151024ddf84384b2517dc6bd9a7bb52d9c607f47583b7b4868e809ad042e7f8e951e6a331004c62335

    • memory/624-0-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/624-109-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2572-95-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2572-100-0x0000000000400000-0x0000000000434000-memory.dmp

      Filesize

      208KB

    • memory/2832-94-0x00000000004C0000-0x00000000004F4000-memory.dmp

      Filesize

      208KB

    • memory/2832-92-0x00000000004C0000-0x00000000004F4000-memory.dmp

      Filesize

      208KB