Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 21:51

General

  • Target

    699ac3f056174e985ee6aec449b70a5a74404634a2e89ece1ca05f521b26ae32.exe

  • Size

    101KB

  • MD5

    fcd2254dfdee293482a1205d0b58fff8

  • SHA1

    3291f93f56d3511e72226348dd33d586260c2803

  • SHA256

    699ac3f056174e985ee6aec449b70a5a74404634a2e89ece1ca05f521b26ae32

  • SHA512

    9faad7b77ce15d7a11475de03dc3855e9aad0c7aff55030e66aa7aa56c4270153f43be3647e4d17bf459a24efb4e9e034c5e85670557ea6aedec1f2cd07cf12e

  • SSDEEP

    1536:0GYU/W2FHG6jMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7o:0fU/Wr6jMauSuiWNi9CO+WARJrWNZW

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\699ac3f056174e985ee6aec449b70a5a74404634a2e89ece1ca05f521b26ae32.exe
    "C:\Users\Admin\AppData\Local\Temp\699ac3f056174e985ee6aec449b70a5a74404634a2e89ece1ca05f521b26ae32.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\ProgramData\Update\wuauclt.exe
      "C:\ProgramData\Update\wuauclt.exe" /run
      2⤵
      • Executes dropped EXE
      PID:2212
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\699ac3f056174e985ee6aec449b70a5a74404634a2e89ece1ca05f521b26ae32.exe" >> NUL
      2⤵
      • Deletes itself
      PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Update\wuauclt.exe

    Filesize

    101KB

    MD5

    8dd9de1d3ef2ae574513600e2c3ab5a4

    SHA1

    13c6472621cdd351c0f2b7482a7012b7d6b8c2ec

    SHA256

    c0ce0d3a4e29efa29c8714e43dfa2f649cb3d7ea5a37b584be322a42984f7275

    SHA512

    7f9272a9e772433ea35d71b6907dde4b5db97666a1c20db7a1194f395fa682f9bd8d547f4272757628b08e1633790708a8fdfd20e5d0ad0a08a728120e705c06

  • memory/1152-0-0x00000000001B0000-0x00000000001CF000-memory.dmp

    Filesize

    124KB

  • memory/1152-4-0x0000000000130000-0x000000000014F000-memory.dmp

    Filesize

    124KB

  • memory/1152-8-0x00000000001B0000-0x00000000001CF000-memory.dmp

    Filesize

    124KB

  • memory/1152-9-0x0000000000130000-0x000000000014F000-memory.dmp

    Filesize

    124KB

  • memory/1152-11-0x00000000001B0000-0x00000000001CF000-memory.dmp

    Filesize

    124KB

  • memory/2212-7-0x00000000000E0000-0x00000000000FF000-memory.dmp

    Filesize

    124KB

  • memory/2212-10-0x00000000000E0000-0x00000000000FF000-memory.dmp

    Filesize

    124KB