Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 09:22

General

  • Target

    7cbff1a4bbc061e3feef7b6aac2cb199.exe

  • Size

    221KB

  • MD5

    7cbff1a4bbc061e3feef7b6aac2cb199

  • SHA1

    2da62197957675d9b643b2f233837602a6b16913

  • SHA256

    b40f12af5c52a4b36b16d7bc02631435074420deb06ac7c01c130ca9b8828237

  • SHA512

    b47c57d9a62a74e80d1dccbd189b0fdb8c905047f9f2fa365d5558d4249f678fa5884921aa3d7bdf0276302897a3a2c4c461ed665a0eb24d9b7d9f56dee273ca

  • SSDEEP

    3072:7I/mS4PL5AcHRW14UZm5TqeNm32egD5Bazp67bOhzI:7I/85/MWUQxh95Bag7b

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cbff1a4bbc061e3feef7b6aac2cb199.exe
    "C:\Users\Admin\AppData\Local\Temp\7cbff1a4bbc061e3feef7b6aac2cb199.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Lpv..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Lpv..bat

    Filesize

    210B

    MD5

    3e15c48abc6403be0c76f43cd744fb9f

    SHA1

    4d9156e1411cd8e8a9a133a0ead07aa8bdf3bc6c

    SHA256

    40b933e775dcd99656b998b49f198c5cba13064e61a78ecbc84cf884ec865253

    SHA512

    b1a9421fe6ddfb64164786248e7750bb336322673dfb20ec6d63b118bb98b55d2d66475ff2b4ba1de89c4db93c386abcea1782c3702b390fd360b8c95f8353d6

  • memory/1072-1-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/1072-0-0x0000000000330000-0x0000000000349000-memory.dmp

    Filesize

    100KB

  • memory/1072-3-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB