Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    163s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 15:08

General

  • Target

    56ca43ba032d7b7929cf2e28207be039.exe

  • Size

    27KB

  • MD5

    56ca43ba032d7b7929cf2e28207be039

  • SHA1

    2fd42dec311104b87d601d406bb4fbd8c158a29f

  • SHA256

    d0fff4c29b2105289d2bb121a80c990e3f7d110f89978a8e8254a9c6eba95784

  • SHA512

    c62c8ad1d100e963505045c0b1fb95eb2896b90673b346c21d4a3f5d80b066320ee11284a45cf1e6b21158cde9fa35b43fb689f12f3a4957187b0dbaf7912820

  • SSDEEP

    768:ENy+CCW5uVi8ZgT2MMWN5xUpGa/9SPji:EN3e58ZgToWN5QSPO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56ca43ba032d7b7929cf2e28207be039.exe
    "C:\Users\Admin\AppData\Local\Temp\56ca43ba032d7b7929cf2e28207be039.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\windows\SysWOW64\win32us.exe
      "C:\windows\system32\win32us.exe" -kill c:\users\admin\appdata\local\temp\56ca43ba032d7b7929cf2e28207be039.exe /install
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\windows\SysWOW64\win32us.exe
        "C:\windows\system32\win32us.exe" -kill c:\windows\syswow64\win32us.exe /install /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\windows\SysWOW64\win32us.exe
          "C:\windows\system32\win32us.exe" -kill c:\windows\syswow64\win32us.exe /install /install /install
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\windows\SysWOW64\win32us.exe
            "C:\windows\system32\win32us.exe" -kill c:\windows\syswow64\win32us.exe /install /install /install /install
            5⤵
            • Executes dropped EXE
            PID:1712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\win32us.exe

    Filesize

    27KB

    MD5

    56ca43ba032d7b7929cf2e28207be039

    SHA1

    2fd42dec311104b87d601d406bb4fbd8c158a29f

    SHA256

    d0fff4c29b2105289d2bb121a80c990e3f7d110f89978a8e8254a9c6eba95784

    SHA512

    c62c8ad1d100e963505045c0b1fb95eb2896b90673b346c21d4a3f5d80b066320ee11284a45cf1e6b21158cde9fa35b43fb689f12f3a4957187b0dbaf7912820

  • memory/2276-0-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2276-6-0x0000000002810000-0x0000000002826000-memory.dmp

    Filesize

    88KB

  • memory/2276-14-0x0000000002810000-0x0000000002826000-memory.dmp

    Filesize

    88KB

  • memory/2276-13-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2436-22-0x0000000000850000-0x0000000000866000-memory.dmp

    Filesize

    88KB

  • memory/2436-24-0x00000000026C0000-0x00000000026CD000-memory.dmp

    Filesize

    52KB

  • memory/2436-15-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2692-27-0x0000000000470000-0x0000000000486000-memory.dmp

    Filesize

    88KB

  • memory/2692-30-0x00000000026D0000-0x00000000026E6000-memory.dmp

    Filesize

    88KB