Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 09:46

General

  • Target

    be4b9cd2e84c1744e29740cf78a374cc.exe

  • Size

    17KB

  • MD5

    be4b9cd2e84c1744e29740cf78a374cc

  • SHA1

    ed35e6099897f7ac480ebc40fb68dcc75c5a52aa

  • SHA256

    bc19f3977391d1ce13ab733e88333d81666ad71de7466576d8354f3e8569b269

  • SHA512

    a2f035cd200c251b1992d0109159ba0c8553af457a9b96aa7e30c189efe3d23a53f1d08379f02f375ca221a9613c450df248e9f68919688023b24b0767fee42e

  • SSDEEP

    384:s5wTs403c90rqxWO6UFjivzTYX9kD7qNezStCAoQ5O6m:GFVqxaUFsTf/qPZ5Fm

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\be4b9cd2e84c1744e29740cf78a374cc.exe
        "C:\Users\Admin\AppData\Local\Temp\be4b9cd2e84c1744e29740cf78a374cc.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Users\Admin\AppData\Local\Temp\LYLOADMR.EXE
          C:\Users\Admin\AppData\Local\Temp\LYLOADMR.EXE "C:\Users\Admin\AppData\Local\Temp\be4b9cd2e84c1744e29740cf78a374cc.exe"
          3⤵
          • Adds policy Run key to start application
          • Deletes itself
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\LYLOADMR.EXE

      Filesize

      13KB

      MD5

      f071f6d487bd5941ceb20e524412295e

      SHA1

      6ff3e2c7cd1d63cafdcbaeebbdfc6c87345aac32

      SHA256

      e7412e454a628b775d6c521607505e57a417d9e55046675fa2fd3c077f17c837

      SHA512

      78aeb406274fca62d4391f82ac801bef915b4c1cefb23a0c2212b9591d8fa2724916f6a9bfc8b82c89fd95b2581e0b5f1bf68841bdc06663009b7a31d67b230d

    • memory/1204-21-0x0000000002970000-0x0000000002971000-memory.dmp

      Filesize

      4KB