Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 23:13

General

  • Target

    97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55.exe

  • Size

    7KB

  • MD5

    ab443ea6d15f67cf20f454658ce4325b

  • SHA1

    c59f879f32f02ace94c3f7ee67dfdab3357dcbb2

  • SHA256

    97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55

  • SHA512

    6609cdf8eb9a20894bb1449bc06269a5cc4a2b6dc6b59e22fb1ca086500cbf9ee69390091d0cbb12a3f2d64403948bffffb33b706e00b850207ac8807619cf3c

  • SSDEEP

    192:GtmcWKG93nKfzum8axTcYx/W8uGkOcNYh:ZKa3KfzumXxTZxhuGDcuh

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55.exe
    "C:\Users\Admin\AppData\Local\Temp\97c8189bf408b9696373001409db2c99ad8728a8f2872f42a5931a965f5d4b55.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\gdlwh.exe
      "C:\Users\Admin\AppData\Local\Temp\gdlwh.exe"
      2⤵
      • Executes dropped EXE
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\gdlwh.exe

    Filesize

    7KB

    MD5

    ea89cdf64650d79a4c8d6b125ba39ff7

    SHA1

    84e6c821f0acd26286f23d67b51f89d533c4157d

    SHA256

    e1fc53d432582e27ed7de89205bd6261e6bddaf2157754c512642d900963d194

    SHA512

    052012a93c1e213641a159b28208965072a9e58d7a16849d9a7ba9b70b4ff73bc0d5a333f2a18a71657713ba3e714b5bf987576af659507b476589dee900b310