Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 10:21

General

  • Target

    15c0c2ce25e4f02d026c60b6dc58b166.exe

  • Size

    344KB

  • MD5

    15c0c2ce25e4f02d026c60b6dc58b166

  • SHA1

    2164a4b678d6bbc8a7948a623da40c42f3d10309

  • SHA256

    4c5ae07738e2ddf31f25f1244551f1dfe36c571fa1b93470a3fd6befb1a57bb8

  • SHA512

    5820add84401e41961d7e8ea33bb2c2b21be4894f242b3309e5825d319edbdc6683a9448f09f5091e210cd2e02e38e3025bcacb1a1dcae0136f234d825ca09bb

  • SSDEEP

    3072:X99UZTQXyZYrG7mEKx/tnq3YuVFr3jW8v6fxVQYGXTBmANksb7c9Xtr3hvB99BFO:p8vExOjjVc9XtrtcIFW

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exe
    "C:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exe
      C:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\AppData\Local\Temp\8DBF.tmp
        C:\Users\Admin\AppData\Local\Temp\8DBF.tmp
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 36
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\8DBF.tmp

    Filesize

    8KB

    MD5

    d04159304832ed17c75a03f4aece0f46

    SHA1

    d85f25676e11b2018f3f68c510664510756ed479

    SHA256

    0470e393ee290cc352cee76cf7e1faa68aaf5bba0fc663c0f62093aa5ca2a0e4

    SHA512

    0f2a6463fee783ef5bb828c547975d90e36b5b46a57b4fdccc47b5be30c5b01e6855023ca3bcf2026299b4c6979ce7fde361c1354ad8ae483a51662e5458f0f8

  • memory/1888-0-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1980-22-0x0000000000400000-0x0000000000402200-memory.dmp

    Filesize

    8KB

  • memory/2748-3-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2748-4-0x0000000000400000-0x000000000040F2B0-memory.dmp

    Filesize

    60KB

  • memory/2748-6-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2748-8-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2748-17-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2748-18-0x0000000000400000-0x000000000040F2B0-memory.dmp

    Filesize

    60KB