Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 17:37

General

  • Target

    8cefd641462ec2b6058d912907966a60.exe

  • Size

    47KB

  • MD5

    8cefd641462ec2b6058d912907966a60

  • SHA1

    0087352cc6de37b24808604574fb90605f37aabc

  • SHA256

    33cd36c906a19b207dc3816b5f919dc762a93de056cac4aec0415d467e36b9c4

  • SHA512

    3c4e3f9aace5e156bbdb884b951d8895e4b1bf2c91ecf27e3d79be12c21674a107facb0cc465739e69532a967fb318887a538fcdd3b6a43c732ee8472ebd3a23

  • SSDEEP

    768:EyW1yBtObv0U/xwPp0EoooiYECG2nZF5sZVcmxu:24Bobv7aB0EooYEC3rUVcYu

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cefd641462ec2b6058d912907966a60.exe
    "C:\Users\Admin\AppData\Local\Temp\8cefd641462ec2b6058d912907966a60.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
      "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
      2⤵
      • Executes dropped EXE
      PID:1676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\zbhnd.exe

    Filesize

    47KB

    MD5

    441ba1b6ba8b980669c00fffe8cc0255

    SHA1

    b6feaae7ccfec60c612a9e2318a0cf820d525b74

    SHA256

    606db105a4daf8a32c72810d6d43a5dad9dfd5d0152049a7b6b9d2643f198ba3

    SHA512

    567fecb0914e11fec39d4f9153b58807b0ee9b178dd8e64112136f45cec5294a3a5b4eecc102197d80f80990c2e20985c4f7ceefb85bf8602efb294f8534af0d

  • memory/1320-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1320-1-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1320-7-0x0000000000700000-0x0000000000709000-memory.dmp

    Filesize

    36KB

  • memory/1676-10-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1676-12-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB