Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 13:05

General

  • Target

    3737b56d4596f1c37355af7fbe660b08.exe

  • Size

    28KB

  • MD5

    3737b56d4596f1c37355af7fbe660b08

  • SHA1

    9aaffc8c47034928102d0807b8ea527eada3ada8

  • SHA256

    86e8499e566afebf6a44a0c3428510e58c51d7eb8395e146b11cb555e99a4058

  • SHA512

    bb3ecdf72775e18d59f5ee73abc2cc532f8fc7c4728e960e7066e1f32e138c0bf5c06ffe5862e650bdb40a37a6bef39066f3cff647770e73c9493e04a0b41f25

  • SSDEEP

    768:uBQuvdXSJDPBz9+wglKpw3pXAOIih+b3Oy4i6k/ROfIF:uWwxSRPBz4BKK1AOeb3b/R6IF

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3737b56d4596f1c37355af7fbe660b08.exe
    "C:\Users\Admin\AppData\Local\Temp\3737b56d4596f1c37355af7fbe660b08.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a..bat

    Filesize

    210B

    MD5

    99ad9f70adb72bdf009eca5d1c0c1206

    SHA1

    03ae92cbc10e68cb367f267eefa35ccf82aba209

    SHA256

    6ec6be1cbc1a57616be9190b576f0b50f73ac98c6c28f2da1cab134d5ae65c0d

    SHA512

    04ff3c1ffde0436f4c969f673b07846f6ce01d248e26b9afcc1d9d4900c78412ebbc2138f42dfb845eba5dbbd99fc26bf644c8b82064a057ef77ed36aefb7e65

  • memory/2124-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2124-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2124-3-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB