Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

4490c29ee9...7d.exe

windows7-x64

7

4490c29ee9...7d.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    155s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 22:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4490c29ee90f751fa17b83b38305fb7d.exe

  • Size

    506KB

  • MD5

    4490c29ee90f751fa17b83b38305fb7d

  • SHA1

    e7c6ea3a6be57dfd04f35c65467b6f18eee078ca

  • SHA256

    7ea48817e8d0f96cbcbe26379a51c2ea6e942c1aabbd5ef12b8f8fee92001db7

  • SHA512

    087293432391c410f4f4c6cb5f21781a1e899f9ed935334cf6e03c7595719e0cdc30a8f868117751d103213b0c25a61ba8c717ea494732405f79f9b8760d74b0

  • SSDEEP

    12288:KSPdnRIRx6v72sIhgiaJES7OIDHZH9Ct4fFhogZlekUvSF:KSPQu72dgJttHZktyh/h1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 9 IoCs
  • Drops file in System32 directory 20 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4490c29ee90f751fa17b83b38305fb7d.exe
    "C:\Users\Admin\AppData\Local\Temp\4490c29ee90f751fa17b83b38305fb7d.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\syswinnt.exe
      C:\Windows\system32\syswinnt.exe 1140 "C:\Users\Admin\AppData\Local\Temp\4490c29ee90f751fa17b83b38305fb7d.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4128
      • C:\Windows\SysWOW64\syswinnt.exe
        C:\Windows\system32\syswinnt.exe 1152 "C:\Windows\SysWOW64\syswinnt.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\SysWOW64\syswinnt.exe
          C:\Windows\system32\syswinnt.exe 1028 "C:\Windows\SysWOW64\syswinnt.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:1504
          • C:\Windows\SysWOW64\syswinnt.exe
            C:\Windows\system32\syswinnt.exe 1124 "C:\Windows\SysWOW64\syswinnt.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:8
            • C:\Windows\SysWOW64\syswinnt.exe
              C:\Windows\system32\syswinnt.exe 1128 "C:\Windows\SysWOW64\syswinnt.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:1112
              • C:\Windows\SysWOW64\syswinnt.exe
                C:\Windows\system32\syswinnt.exe 1136 "C:\Windows\SysWOW64\syswinnt.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:4108
                • C:\Windows\SysWOW64\syswinnt.exe
                  C:\Windows\system32\syswinnt.exe 1132 "C:\Windows\SysWOW64\syswinnt.exe"
                  8⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:5028
                  • C:\Windows\SysWOW64\syswinnt.exe
                    C:\Windows\system32\syswinnt.exe 1148 "C:\Windows\SysWOW64\syswinnt.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:3204
                    • C:\Windows\SysWOW64\syswinnt.exe
                      C:\Windows\system32\syswinnt.exe 1144 "C:\Windows\SysWOW64\syswinnt.exe"
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\syswinnt.exe
    Filesize

    506KB

    MD5

    4490c29ee90f751fa17b83b38305fb7d

    SHA1

    e7c6ea3a6be57dfd04f35c65467b6f18eee078ca

    SHA256

    7ea48817e8d0f96cbcbe26379a51c2ea6e942c1aabbd5ef12b8f8fee92001db7

    SHA512

    087293432391c410f4f4c6cb5f21781a1e899f9ed935334cf6e03c7595719e0cdc30a8f868117751d103213b0c25a61ba8c717ea494732405f79f9b8760d74b0

    Download Submit