Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 21:04

General

  • Target

    1c6e67a77cb445f00fa886077124b3df.exe

  • Size

    110KB

  • MD5

    1c6e67a77cb445f00fa886077124b3df

  • SHA1

    ff995b682993edc703fe03c499accfe96e8738cd

  • SHA256

    90fdabf545a44524a5798c4f5d89cc56e30161efb6db6f3d7984ac3ad3e3081e

  • SHA512

    660cf6a9f7e5b3e0b0acb4670349ea02a37ff2b71d078fee16b5f6047ec0beedd3a85d8b215ef54cf2f5c1715d681063cd1ab67aa9b264cfd06c165e26c3eeb1

  • SSDEEP

    1536:h0LFGxfLR3JaTNjDTJIBTtL9qfEovoWODtaqPhNm1ekqan2kMI:hMGh1Ja1q3L9qfHIDbJNvV

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c6e67a77cb445f00fa886077124b3df.exe
    "C:\Users\Admin\AppData\Local\Temp\1c6e67a77cb445f00fa886077124b3df.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Xjv..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:1680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Xjv..bat

    Filesize

    210B

    MD5

    2ec3a1c961c01d95e69232cc072a4a76

    SHA1

    d85252223fed96169f9c2ea1e8116e9e1f572ee2

    SHA256

    abfaea85589b505b1a93e7acde85e0cac877d724168ce451cfee3c801e0b24b5

    SHA512

    d44e1319015951d132402816c32a7d84d5ad64fa3788748d948652c982c523f8664e31ce832457da4628513680f4eebeceb70db5b27235f745ad3894cf9e8912

  • memory/2288-0-0x0000000000130000-0x0000000000147000-memory.dmp

    Filesize

    92KB

  • memory/2288-1-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2288-3-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB