Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 06:24

General

  • Target

    967bf8e9e6bb93e8f6bbaf0de8837e0b.exe

  • Size

    304KB

  • MD5

    967bf8e9e6bb93e8f6bbaf0de8837e0b

  • SHA1

    dc43d7cc1f3475efc52540537b55760f7dccf4e2

  • SHA256

    135a362efc459afda7d1674ff3e16bf6213c57a64aa7bc451fe327a24aa12d4d

  • SHA512

    e79257157ddb80ff9a5a656b5f013e65ebb8ce70a1031acb5b8af4653da6c2f251a3a1ee494319bb6efc790929c7e6a7f003bf93fd50b0ee689bd175c71af5d8

  • SSDEEP

    6144:irkw6Y0JQBkQRl7174NpNUM+UHs+tPvpqvpQAy+L9hMk+W60z4RRWf:irkw63yRl1uqM+gs+tPvEpPy+rMzuf

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\967bf8e9e6bb93e8f6bbaf0de8837e0b.exe
    "C:\Users\Admin\AppData\Local\Temp\967bf8e9e6bb93e8f6bbaf0de8837e0b.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TsuE7E2F964.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • C:\Users\Admin\AppData\Local\Temp\{0AB81821-6CFC-4838-AAD3-24DED15B3AD7}\Custom.dll

    Filesize

    73KB

    MD5

    56a2a892987268718445147b7ddd0a98

    SHA1

    d56fe3883d4d286322981ea07d027554ad52a955

    SHA256

    5a5245919bb55d392a5e45563af2dc22a15a48a6e9e70b964b7ce339eb02a40f

    SHA512

    ef0d74fb6747006f9c997e6a43beb4de7cf72fc19000d7949da2c1a6251b9c07aa0c082a549a0b3d3e4a2f5a62682e0346ff8234457ba385488ef874fc600401

  • C:\Users\Admin\AppData\Local\Temp\{0AB81821-6CFC-4838-AAD3-24DED15B3AD7}\_Setup.dll

    Filesize

    167KB

    MD5

    dc4d3ad609418f3941a2b5321944f80b

    SHA1

    b00e079e20a7d6bb3695407063b16a56b9de4eb0

    SHA256

    1681c8e8a8233e3f564afebe035cb912f367233a855046241433ddd06abf17bd

    SHA512

    291bc20ec28faccf8080150e9ff98ebcbc4a6e81290ba36367ab3c77d8dcf7be437a6eaf47586a527665332d185b41f78b6850d756a370db69a95da8425e349d