Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/01/2024, 07:13

General

  • Target

    403990c6cbb042f7c1f5e57177272f81.exe

  • Size

    1.3MB

  • MD5

    403990c6cbb042f7c1f5e57177272f81

  • SHA1

    ab9ef44ed7b93ecf7b6c43f23d75a3f2dc9d5a1b

  • SHA256

    42af92e5be37c1daddda7672372a39ccebb24d31d2ea65bec2a74dfbc3a4e82c

  • SHA512

    cb1adffb69f4ff6a62257325504cebc41d22f41910a41eae9c04ec5327da9f58fb652e79b87f580c7ac6f81f27cf2fba77b4fc3947b27dd59ae376f2d7c57ee5

  • SSDEEP

    24576:hW5Df+qq6n4nP3P/oldSC+v18pqOxtKBsYOkP7Jz5I4MZ+xnF84gv41bb1tnKx4/:h9tvMqkm15SnDF5IPsmAjinh

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\403990c6cbb042f7c1f5e57177272f81.exe
    "C:\Users\Admin\AppData\Local\Temp\403990c6cbb042f7c1f5e57177272f81.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\viix2i0u.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES693F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC693E.tmp"
        3⤵
          PID:2832

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Cab8393.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\RES693F.tmp

      Filesize

      1KB

      MD5

      4258bd858d83677a09b2e8b8ddcbc812

      SHA1

      3f35ecf509b10009872cae87e5961f704b2b29a3

      SHA256

      6e78e1f8dd3ebd779bc807eb7d4c8c1a20cde22c44b9380c2acec6b815f6b032

      SHA512

      045639838823a768674ff7c4f5fb79c1f230bef9a61d1af165c3850012057960d4e0b22b765626d849cc02db1021b2c1f9cafc9d2a3d3175bb0d0a6c597b105b

    • C:\Users\Admin\AppData\Local\Temp\TarF04D.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Local\Temp\viix2i0u.dll

      Filesize

      76KB

      MD5

      f4fe079e8aaa36dd94497170a4ad757b

      SHA1

      bbc5b3f6d450a2240ee2128be4c8f17863c3380f

      SHA256

      dd8f7d80273e77297347ba38a57d996bf2c3dbf125ed4250eaa2e1161e287729

      SHA512

      ce386d930781aef5c7811ea03fb9f1770e99be407a8a5a6ff4d7c94302c08431d35c899152237d48cb61713fd639c49e8cd42d051b1ffbd589230d97fcddb10e

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC693E.tmp

      Filesize

      676B

      MD5

      44aa3ec5305aada3f5f0ef67f1c6adaa

      SHA1

      5f7d67230ffe2ce924457268a4e258e1fd76125f

      SHA256

      25e088d7e38cb9a169c13d87659e261a18083c9b492a0597b651735946f61ecf

      SHA512

      7b5e64a649d1045a7434a95670da97f5f42bf3eaeb5d5e897411ec31cda5bf8c31e895b8850c01d2a8e2267f90640c17d564db8250c43fac563b95ad3a0c1d4f

    • \??\c:\Users\Admin\AppData\Local\Temp\viix2i0u.0.cs

      Filesize

      208KB

      MD5

      2fcb165ed62080a094dc317178fcc368

      SHA1

      ede1e71260bd57616388c192aec684498453af97

      SHA256

      937d2d4a2b9e43fb0f5ad3b3c0a6baf79039417575c4e861c497a69ea283e565

      SHA512

      203b177127da112964e4bec9f6cb7dcccc573366a67e344015bb72d13311322c52eb294ee6057d0e978d925373a39366dd95e320c0b2f31b945fae431de6ebe9

    • \??\c:\Users\Admin\AppData\Local\Temp\viix2i0u.cmdline

      Filesize

      349B

      MD5

      e812b334c2cba2a0ad9240e7b647c50d

      SHA1

      03530f5276de50144b8f79b91a833af6a3055e8b

      SHA256

      3bb6890329216be1d35bdcf9ecc3e9df74931b3468fe69b3dc3d786586827d14

      SHA512

      57524bdc2be2522e3899b74da770fde6d55a301d4672348ddf90e04e6d56a3546dc99dd961ad1bed95080cfeda293e8f61649a0cdf7e8e72fbe55776e0552676

    • \Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

      Filesize

      39KB

      MD5

      d80d1b6d9a6d5986fa47f6f8487030e1

      SHA1

      8f5773bf9eca43b079c1766b2e9f44cc90bd9215

      SHA256

      446128f1712da8064d0197376184315cb529ed26ed9122f7b171bb208e22c0c3

      SHA512

      9fcf0105c2c9ee81c526d41633d93579bb8e2837989d77fb4a6523440415ec2d7fa46ac9ae4e55ecebd99126837817ac308cc079475de02667b21727a43d74cc

    • memory/2088-15-0x00000000004E0000-0x00000000004EE000-memory.dmp

      Filesize

      56KB

    • memory/2088-34-0x0000000001280000-0x0000000001298000-memory.dmp

      Filesize

      96KB

    • memory/2088-16-0x000000001B200000-0x000000001B25C000-memory.dmp

      Filesize

      368KB

    • memory/2088-75-0x0000000000630000-0x00000000006B0000-memory.dmp

      Filesize

      512KB

    • memory/2088-0-0x0000000000590000-0x000000000059C000-memory.dmp

      Filesize

      48KB

    • memory/2088-14-0x0000000000630000-0x00000000006B0000-memory.dmp

      Filesize

      512KB

    • memory/2088-3-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

      Filesize

      9.6MB

    • memory/2088-31-0x000000001AF30000-0x000000001AF46000-memory.dmp

      Filesize

      88KB

    • memory/2088-33-0x0000000000550000-0x0000000000562000-memory.dmp

      Filesize

      72KB

    • memory/2088-17-0x00000000012B0000-0x00000000012FE000-memory.dmp

      Filesize

      312KB

    • memory/2088-36-0x0000000000630000-0x00000000006B0000-memory.dmp

      Filesize

      512KB

    • memory/2088-35-0x0000000000570000-0x0000000000580000-memory.dmp

      Filesize

      64KB

    • memory/2088-2-0x0000000000630000-0x00000000006B0000-memory.dmp

      Filesize

      512KB

    • memory/2088-53-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

      Filesize

      9.6MB

    • memory/2088-54-0x0000000000630000-0x00000000006B0000-memory.dmp

      Filesize

      512KB

    • memory/2088-1-0x000007FEF6230000-0x000007FEF6BCD000-memory.dmp

      Filesize

      9.6MB

    • memory/2088-73-0x0000000000630000-0x00000000006B0000-memory.dmp

      Filesize

      512KB

    • memory/2088-74-0x0000000000630000-0x00000000006B0000-memory.dmp

      Filesize

      512KB

    • memory/2924-23-0x00000000020E0000-0x0000000002160000-memory.dmp

      Filesize

      512KB