Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 05:30

General

  • Target

    42e15a6ef1dc6d2cc85a6b42b6cb8260.exe

  • Size

    133KB

  • MD5

    42e15a6ef1dc6d2cc85a6b42b6cb8260

  • SHA1

    cd228accdd47da7b6318811de1043705562d2924

  • SHA256

    5ec198ff9c73d9a678840540d2f58f67976f80c8801efd4a762c32476508b81e

  • SHA512

    3aee5dc0536104c6e02e91038017cc5a66acc706dcdf0f8bf5e8a63a913d429d6a6d4f6b831032dbea63a90d19f8d08da9e5a402512e480a9a9fffee00a39027

  • SSDEEP

    3072:KBFbrajR/V9xuVQTVuR/8PWrJkdiqyj5KzctLO:EFHgHxuVQSkPW6diqy1a

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Drops startup file 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
    3
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
      5
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2476
  • C:\Users\Admin\AppData\Local\eyirad.exe
    C:\Users\Admin\AppData\Local\eyirad.exe
    1⤵
    • Drops startup file
    • Executes dropped EXE
    • Adds Run key to start application
    PID:2908
  • C:\Users\Admin\AppData\Local\eyirad.exe
    7
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1532
  • C:\Users\Admin\AppData\Local\eyirad.exe
    5
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2452
  • C:\Users\Admin\AppData\Local\eyirad.exe
    3
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2716
  • C:\Users\Admin\AppData\Local\eyirad.exe
    1
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2660
  • C:\Users\Admin\AppData\Local\eyirad.exe
    "C:\Users\Admin\AppData\Local\eyirad.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3064
  • C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram 1.exe 1 ENABLE
    1⤵
    • Modifies Windows Firewall
    PID:2892
  • C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
    C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2796
  • C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
    7
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2016
  • C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
    1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
  • C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
    "C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    14KB

    MD5

    054c50f1d5cf38a3d95ca0f28d0c6e2f

    SHA1

    306f88e05fcc45f9d16e3bdc881a72fab555e8e6

    SHA256

    96fde6425963c7ba81dcbd309f6745640d9b345d7195a6452186d01eb1a95ae6

    SHA512

    0dd3ed386601906f1ff5bc109bd5bee217cb20d3876a09961f2c646070eeacfe14ecfd793b8cb38ce30d6b229cb867a6dfe5833a8b53747edcd298f5c5f151dc

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    49KB

    MD5

    07604f979c5d98de43b9af7976c2b401

    SHA1

    69bc9ffafa8ec9e39f53c2417f8431bb1f10398b

    SHA256

    2c4ceb643005305bdd83a9ca7c5bdcd3dfe8f17c1bbd8d7302c5ba8bbe8197e1

    SHA512

    6fb90db669b556edea2d70463631844571dc77ba4510a973c7f82b933c6137a7b04861c86546f1e4060c65529beffdfbdde72ed91caf65bdbb37e1168b2efff9

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    49KB

    MD5

    ff29d170565481ff8b9a6b4b6dee40c9

    SHA1

    12343012323a68df16ac81ed238e70721f3e073d

    SHA256

    a45918c0037a4f888de1e576ca2fcbdcbe46784cee194e1a21755650adb1cf0e

    SHA512

    5468bd661a23bdd01113d10aaa13abe6f613eefe00a1182c7a1f36e30e5846930c3832fcfc4470a8701b0998c42950de713992fc74ab362ee567633bc68bdc49

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    59KB

    MD5

    2791622f64eaa4890eaeee2dc2454a96

    SHA1

    c7406c8a2d2d227121fde71791012c0fdbc17468

    SHA256

    a2f3828e455c16dd25a58b4589cc2b9fee0a7b3da7cdf05174c2b5721cc73c61

    SHA512

    e88a7ca4c1a59722f89f511e8c44c20a6abae330d8ae6fdd2b1a2d6dce62c87fb93349a4cc44d31dadae8be05e2b11bad7639618053fa645cb2870540f25d362

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    59KB

    MD5

    4f91d20fcca16de9e44c1c40cd815693

    SHA1

    ec7abba8f51e7cea230548dafa29e9742dce480e

    SHA256

    a4be69b2892d51a818cae589f7417ea73a371106a7fbc2ec3b088cda5d85df4a

    SHA512

    cd5ef5c04fc5a130bcd210ae6cb6e858050156f1979dbf1c9680fb50e52bc956c0c5e8768d9b4b4017e5a92f40395ebfb88f14cd61213c376346f89790078b93

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    58KB

    MD5

    22d13be8760c523bc0ee9919f37eca2d

    SHA1

    7f8f644ce5f69a95d899ae43841e45873ef25aeb

    SHA256

    f2698d8d80bfa7a29cc94470a6329df0b47cde2b6d0e5291a586258d4dccb30d

    SHA512

    b2d81dc5036236cc2e721be10a9f8eedf5d166e538e2fce93e415fb0cc1e781a146baa630746856f523583ef720aabcc6faaf1fb84c9306bea844d281bc0a95a

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    65KB

    MD5

    4186dfb099ffc76aab7314319f5624c5

    SHA1

    de95535f73108cb37926d88aa1c24155bdf57659

    SHA256

    e0c775b0ba414248c25660036eabed4c09517c073abe2368609fd3ce22af0e54

    SHA512

    ddac08e38ce2dd0c1d684eeecbe9048b9610128ce006dac84a233274ee38beab255a7cfdc500c3f26d466dae92d51ced86b30944368409349b48ecb51e4f92a3

  • C:\Users\Admin\AppData\Local\eyirad.exe

    Filesize

    9KB

    MD5

    934afce9cd2744037d648e519b781f2d

    SHA1

    b3667a09649b72b27f83841e2fc8884975f3fe29

    SHA256

    4acdab43462512e43666856cb1021fd9bbb1e5ace7b1a24690e6fe49bc23cd81

    SHA512

    f473922cfbf8b64f170fe69f12a7c8f69df49a1e8b1a68e529c6ce8e5efd9e21fd175272df56cacebbb449a534db3d9692c4fdf31b31cc0b4d08dae0061049ab

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dmxkn.exe

    Filesize

    67KB

    MD5

    08e20d01488e994fcba0ee03cdbf694f

    SHA1

    8c8aa6e16ded4db710e8bed304ee431f35fe3509

    SHA256

    3b6938cc262afd867c2a47f80ae24493c937b3aa0fb550c7970f4b10251db2fa

    SHA512

    e247f5dc32b91f619f2d229d80496baab126ff2f6068d7dfb915091652eb64339af1c207cd060cc68e256ef6919e5145a1c221c228033744af84040dcbd29eca

  • \Users\Admin\AppData\Local\eyirad.exe

    Filesize

    29KB

    MD5

    b9dbdc26ee3ee0a60d64ab2e8ebfca3f

    SHA1

    4c8f255bf442d89738e6b7a0c2ea85b120d33eee

    SHA256

    6022bec173cb093befcdef91d33eb2a86eb4482436c3e989baf2496f6c113c19

    SHA512

    2c4ce4ddddf8724912768408e6a510b1f6bb50ec4793d804532bf1f1397c4b6827e3231550635b7e32cf376cc51dae422704e5bf1e6c71ebac54ef6cf36c343c

  • \Users\Admin\AppData\Local\eyirad.exe

    Filesize

    56KB

    MD5

    14aa37dcb8bc4de167fa2e683200af8b

    SHA1

    cdcacd37421659913758f1dbcf1b934941028e76

    SHA256

    d1a6f0ffaa8a63efcff69251ddd5f4e3fcabb2ec67a4b3599ec2bf111bd5052c

    SHA512

    8f9ad6647e74892c38587d47b3f31ee6c2e87b321fbdb0303eb3c1202f4192172178b630c59ca7aa636c7fb7ddbe3dd7cdbab77b09e8f53520940ae2c86a1f56

  • \Users\Admin\AppData\Local\eyirad.exe

    Filesize

    44KB

    MD5

    39a7c3f13527528ecdf88ef11beb5dbf

    SHA1

    de17629b29cd720dcaedbf9d554572c646997ea3

    SHA256

    7f5801476901958a7b68a783e50c7365459f82de2a068a1933a88109c9e60857

    SHA512

    e62de98ff83ea22104446894e82bd6a7553faa4d2f9076b476e144afdb0c7a6b536c5c64358c38b4cb1757968f605eedb2a2c9880735a866a2a29c2eaa50dae5

  • \Users\Admin\AppData\Local\eyirad.exe

    Filesize

    44KB

    MD5

    642530cad16602ca0171fb2b2289b940

    SHA1

    212d823ea15e3681d8d64a2c4d2cdd4053d9941a

    SHA256

    d487cc54620ae5810a0a7c24afd4079fd0d6b3a7e62e9d28d3ba4738e853089c

    SHA512

    611eabc729303b594668e541a5069e240ecbc58603ace24114b48f076154684298ebfaab25c9f4a515881f26d79708d953f4ded159d53d940f13382eaa10b45d

  • \Users\Admin\AppData\Local\eyirad.exe

    Filesize

    83KB

    MD5

    7534714c9cd4d683bf0b0a73865bbd09

    SHA1

    3b024be275d0b13b86023cb14e7e22edbc193b54

    SHA256

    0baf6a8701abfc8a614192a1816911eb00a7e1d46fd8cf1b2df1c1b86deb2bc2

    SHA512

    97caec77d27fc064518d8645575c9d9198cdf5eefcd0ec4fc4d742854bbfb3560c53fa41f1954171f68a4296306308384f9dd536466d76c1074b5c3cef9b410b

  • \Users\Admin\AppData\Local\eyirad.exe

    Filesize

    80KB

    MD5

    29b86bd14c0519f44042b5944af96bad

    SHA1

    f27c6c41ca23e799ec7e56931e71b3a34046157d

    SHA256

    1533f3349c75e36aa14ba47ed9c4c3a2cd9bcf43716da250864309fd5c03aa8c

    SHA512

    d1b832b31025729d268218a6f93844a4da2506121ad811bb4c8e06bc34201f03be9be7fd8f879a90136aa62efbb3ea1a6871863350c96cd40d916cbd3e078478

  • memory/1532-132-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/1532-118-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/1532-112-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/1532-114-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/1532-116-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/1532-125-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2016-42-0x0000000000560000-0x0000000000660000-memory.dmp

    Filesize

    1024KB

  • memory/2016-40-0x0000000000560000-0x0000000000660000-memory.dmp

    Filesize

    1024KB

  • memory/2796-39-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2796-37-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2796-51-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2796-35-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2796-50-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2796-48-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2796-43-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2796-119-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-131-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-136-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-129-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-127-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-133-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-134-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-135-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-130-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-137-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-138-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-139-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-140-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-141-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-142-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-143-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2908-144-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB