Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 07:03

General

  • Target

    55cc21ce1beae463a4a6a9c9296e29b8.exe

  • Size

    27KB

  • MD5

    55cc21ce1beae463a4a6a9c9296e29b8

  • SHA1

    9ffa06a816471e53253f4403ecf254b3c61b4107

  • SHA256

    bdc3c1553bbc7656e1b1337b116c64ad5d3c6e92b9c59a88e8695c08cbd1a96e

  • SHA512

    5703e67e392fc670ebcad5431dbc966bc38e3fbe3003021bf9324e7da0e1c65f92dea81201910fcd7d77bd69b0ce3aad14ed5f353aa148a37e52fa558cd48241

  • SSDEEP

    768:G8aKH1BMPGjlqVg19YILWjujkfEwAXKGomAoli3Lb:yKH1B0Gjlag17Wk2Ew2KG1A33n

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\system32\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\~~f768a45.~~~" ,C:\Users\Admin\AppData\Local\Temp\55cc21ce1beae463a4a6a9c9296e29b8.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\~~f768a45.~~~" ,C:\Users\Admin\AppData\Local\Temp\55cc21ce1beae463a4a6a9c9296e29b8.exe
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1940
  • C:\Users\Admin\AppData\Local\Temp\55cc21ce1beae463a4a6a9c9296e29b8.exe
    "C:\Users\Admin\AppData\Local\Temp\55cc21ce1beae463a4a6a9c9296e29b8.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~~f768a45.~~~

    Filesize

    37KB

    MD5

    f68e834484cc7cc357322a54f883a4c2

    SHA1

    dc660aabf2c7fd56020f95771ec58a50efa51fd6

    SHA256

    d3396f8ebce6244ee04368c6955730897106bf0c2b2b6da4742285f14c60727d

    SHA512

    518c6167a70a6db5e02e0c95e9c33cc9872e0528760d005ea97b856bd32729604f32a75542646b3e13c903e7ee71e465526c5e91a4865b3dc0b144dd3fba6ef5

  • \Users\Admin\AppData\Local\Temp\~~f768a45.~~~

    Filesize

    103KB

    MD5

    34f9a7928f233544452a11bd5c4e7ffb

    SHA1

    92cedf78118cc4f768cf6d18865b74f77c42db64

    SHA256

    ec6757a5baddf79bd90a839eaae12c9db63d043d3db1e8edb91ff2761e70d12d

    SHA512

    63213c2d858bfe559af164b49486af9d5fa6cdb1bc34c08dcde5a40a7b18d2e8af0032293da60cec625fa86f4963a25c8ef0d13efcef48d948f885ce91828ff2