Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    46s
  • max time network
    40s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2024, 02:39

General

  • Target

    524fd5b6e3cc155ea10ac84d42d87ca2.exe

  • Size

    41KB

  • MD5

    524fd5b6e3cc155ea10ac84d42d87ca2

  • SHA1

    4b842b70d55dc127c84a4fbbd02b595cf59eb9c6

  • SHA256

    e61e9e45dbf2f7ec988478840963279b5d36a3aca13ddede09e2256cc7a7693f

  • SHA512

    4605ec19131fd8764c02358cde2548bab94b43fb7427902e5ee68a0c4f09abd42b43e618508e6757d6e1ec6578c6c5aec468a79f2abcb74232817b961171dea2

  • SSDEEP

    768:xoLjEjX99ddWMr+I1WlEkuqFeBGtrfYeqqD:WMX9n7kuN4sls

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\524fd5b6e3cc155ea10ac84d42d87ca2.exe
    "C:\Users\Admin\AppData\Local\Temp\524fd5b6e3cc155ea10ac84d42d87ca2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\CryptischerMist.bat" "
      2⤵
        PID:2656

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\CryptischerMist.bat

      Filesize

      36B

      MD5

      076697540dc22bae9831a47b91f9d061

      SHA1

      22944d2cb4087ee1cfe16f349f4e25a2b420a482

      SHA256

      8a10ce98121abc2fdfeadcdc28a2641296ecfecfb5921b19fbff9b41807e4e27

      SHA512

      2ab76759b28806d0fd5037e525a0fbe6233aef821d1f7d62b80f0fd1f474692757a73839fd7ab215c09f4e6f44d005efb7f028c3090f1a8c7b08ee0a3ea7009d

    • memory/2780-0-0x0000000000E00000-0x0000000000E10000-memory.dmp

      Filesize

      64KB

    • memory/2780-1-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

      Filesize

      9.9MB

    • memory/2780-11-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

      Filesize

      9.9MB