Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

b5bcf9d796...84.exe

windows7-x64

7

b5bcf9d796...84.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 21:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b5bcf9d796bd46d6c515fff542fa2984.exe

  • Size

    1.9MB

  • MD5

    b5bcf9d796bd46d6c515fff542fa2984

  • SHA1

    d74d0815c9892db0556e992ee7d0b9ee65a75de5

  • SHA256

    d8cc91acd9edb70aa29f20737b546b7d439bbda5ea2552336a334f8f7bcf6d26

  • SHA512

    e90cdb9cceb8f7e7f751be708599dd7334375ad6627df92e1d9de80f51915bdef74743f4aa67f2b50fb8eaa599d54b0c973d15ac71c14514603acb8a842199cc

  • SSDEEP

    49152:Qoa1taC070druvA2y3jkslkjIhGOVTT2mLR:Qoa1taC0c2oosl86V/2mF

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5bcf9d796bd46d6c515fff542fa2984.exe
    "C:\Users\Admin\AppData\Local\Temp\b5bcf9d796bd46d6c515fff542fa2984.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Users\Admin\AppData\Local\Temp\B1D2.tmp
      "C:\Users\Admin\AppData\Local\Temp\B1D2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\b5bcf9d796bd46d6c515fff542fa2984.exe 2DEA74EC937C2ED8E4A3C42271A994B90B518EB6ACE2052C38D1F38A057787E97C64DB25FC8136CBBD900D5A06AD3A4519F11C8772D8828DC6E848FE4D87552F
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\B1D2.tmp
    Filesize

    1.9MB

    MD5

    9975f3ec10603a56860559d3f7756317

    SHA1

    e8f8add8c3a8dfab6ebffe72c817737c9540ac9f

    SHA256

    1e5889ebc5c68a24050ab28e1ebd65e043e373de994e7917725461d99aad72fe

    SHA512

    0f6ee8c13addb890915a07f4ca8077ccafbbe400ef1095bc484d4bab526e03bad17abdbcc0bb2e55b32ca77c0904a4418fcf36c6ef4e4288a12970aa1d35264a

    Download Submit

  • memory/848-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1556-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download