Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 13:07

General

  • Target

    3749239871d1967c508845009be30d03.exe

  • Size

    96KB

  • MD5

    3749239871d1967c508845009be30d03

  • SHA1

    f1a015f646233b4e1956e904c9d067774df35f1a

  • SHA256

    02b282e849ae6fceee2fd788aecff2c4fdacf08ba1a09de0b421f2086f8a65f8

  • SHA512

    87013e4dcd75eb5b4dc5a854192f7067d7b4da7c1fc704455b6d75a47bcb1dee7cee065e89d8406939d01e0c2d1f5b3fa92f0822f778a64ed2aa477b2c047600

  • SSDEEP

    1536:iohBHef6cOahokGulSc16l6u+NMMl/KlYv1T4hThFNNIjni:9IhRlu88FFNCni

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3749239871d1967c508845009be30d03.exe
    "C:\Users\Admin\AppData\Local\Temp\3749239871d1967c508845009be30d03.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\wvxot.exe
      "C:\Users\Admin\wvxot.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\wvxot.exe

    Filesize

    96KB

    MD5

    e975871ef17fcb92af853c8628cdbc5e

    SHA1

    1f55c699c381f51ebaaf17337e30d64368eccca1

    SHA256

    c10ba9f438d4c3139ca967fff51a20f41433e7accf680dec646f0e6f49b06c5d

    SHA512

    0beb7019f884778fb669b8e3817b7ba1be3ba837fb0398d3a81dead2a495efda7a639734253647e5b742d741fd31580ff379c2d35471585954c73947e64f31ee