Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 22:14

General

  • Target

    4490c29ee90f751fa17b83b38305fb7d.exe

  • Size

    506KB

  • MD5

    4490c29ee90f751fa17b83b38305fb7d

  • SHA1

    e7c6ea3a6be57dfd04f35c65467b6f18eee078ca

  • SHA256

    7ea48817e8d0f96cbcbe26379a51c2ea6e942c1aabbd5ef12b8f8fee92001db7

  • SHA512

    087293432391c410f4f4c6cb5f21781a1e899f9ed935334cf6e03c7595719e0cdc30a8f868117751d103213b0c25a61ba8c717ea494732405f79f9b8760d74b0

  • SSDEEP

    12288:KSPdnRIRx6v72sIhgiaJES7OIDHZH9Ct4fFhogZlekUvSF:KSPQu72dgJttHZktyh/h1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 20 IoCs
  • Drops file in System32 directory 22 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4490c29ee90f751fa17b83b38305fb7d.exe
    "C:\Users\Admin\AppData\Local\Temp\4490c29ee90f751fa17b83b38305fb7d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\syswinnt.exe
      C:\Windows\system32\syswinnt.exe 492 "C:\Users\Admin\AppData\Local\Temp\4490c29ee90f751fa17b83b38305fb7d.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\SysWOW64\syswinnt.exe
        C:\Windows\system32\syswinnt.exe 548 "C:\Windows\SysWOW64\syswinnt.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Windows\SysWOW64\syswinnt.exe
          C:\Windows\system32\syswinnt.exe 528 "C:\Windows\SysWOW64\syswinnt.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:2576
          • C:\Windows\SysWOW64\syswinnt.exe
            C:\Windows\system32\syswinnt.exe 552 "C:\Windows\SysWOW64\syswinnt.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1012
            • C:\Windows\SysWOW64\syswinnt.exe
              C:\Windows\system32\syswinnt.exe 536 "C:\Windows\SysWOW64\syswinnt.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:368
              • C:\Windows\SysWOW64\syswinnt.exe
                C:\Windows\system32\syswinnt.exe 560 "C:\Windows\SysWOW64\syswinnt.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:2948
                • C:\Windows\SysWOW64\syswinnt.exe
                  C:\Windows\system32\syswinnt.exe 540 "C:\Windows\SysWOW64\syswinnt.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:2204
                  • C:\Windows\SysWOW64\syswinnt.exe
                    C:\Windows\system32\syswinnt.exe 568 "C:\Windows\SysWOW64\syswinnt.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:2904
                    • C:\Windows\SysWOW64\syswinnt.exe
                      C:\Windows\system32\syswinnt.exe 544 "C:\Windows\SysWOW64\syswinnt.exe"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • Suspicious use of WriteProcessMemory
                      PID:1748
                      • C:\Windows\SysWOW64\syswinnt.exe
                        C:\Windows\system32\syswinnt.exe 564 "C:\Windows\SysWOW64\syswinnt.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\syswinnt.exe

    Filesize

    506KB

    MD5

    4490c29ee90f751fa17b83b38305fb7d

    SHA1

    e7c6ea3a6be57dfd04f35c65467b6f18eee078ca

    SHA256

    7ea48817e8d0f96cbcbe26379a51c2ea6e942c1aabbd5ef12b8f8fee92001db7

    SHA512

    087293432391c410f4f4c6cb5f21781a1e899f9ed935334cf6e03c7595719e0cdc30a8f868117751d103213b0c25a61ba8c717ea494732405f79f9b8760d74b0