Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

a1ac558b7b...8f.exe

windows7-x64

7

a1ac558b7b...8f.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2024, 10:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a1ac558b7bce0e54f9c3dd566924f08f.exe

  • Size

    1.9MB

  • MD5

    a1ac558b7bce0e54f9c3dd566924f08f

  • SHA1

    06069040c10764c62c03536c1c8863263b4824d7

  • SHA256

    a6d5618968b7e84fad19d98c28fee31fa5feefc0af431107a53fd8f5f74dc219

  • SHA512

    6321d2d003635e6ba9bedf31fde31bd1ba06d09768daf2226476e8734916a026c0c419cfd9961d12b59cb0357b9f410e31debeae0f07c09052a777bb849c9d6f

  • SSDEEP

    49152:Qoa1taC070d6cCGU2/eiJP8/P7Rah72TMIOpzS:Qoa1taC0H3li90NYKwIKzS

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1ac558b7bce0e54f9c3dd566924f08f.exe
    "C:\Users\Admin\AppData\Local\Temp\a1ac558b7bce0e54f9c3dd566924f08f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\1507.tmp
      "C:\Users\Admin\AppData\Local\Temp\1507.tmp" --splashC:\Users\Admin\AppData\Local\Temp\a1ac558b7bce0e54f9c3dd566924f08f.exe 8003C1ED806CBCBDCB760F5511C161252CA8E8BDDD11CE2B600217AAE9F40F65EDF95FA74F625CAEC9D23559D36EA5499A8898CDD9FF48E3BB503C92E4EC9771
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1507.tmp
    Filesize

    1.9MB

    MD5

    57a245c276c30986a1fa29af8eac73e5

    SHA1

    73f62a3f42c3ade7ab7d2d11c555f26bbfecc45d

    SHA256

    8b2c924cea33bdc76a6b2ab1b95026d49dc44c8cd919f4f248ac0889509eab08

    SHA512

    96cb89ee366248340da571a5b1c475b23179e337c6152d0563f349b6df63e9fe85449afb190a4e93dfe5bf5bd25b8a97153c976ea92345836cd25096e62e218f

    Download Submit

  • memory/1660-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2720-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download