Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 03:38

General

  • Target

    b185ee1d0e238b92148737f4a760c681.exe

  • Size

    344KB

  • MD5

    b185ee1d0e238b92148737f4a760c681

  • SHA1

    c99f6e20909a78cf70384dd6df4fa6591632b2e0

  • SHA256

    c5f8f6569fac20e7f0f94c7c717cf20949cb06d256ac2447aa4eef1f9ab4bfca

  • SHA512

    20e144a638687638eda9b80d4ff649e7824cc657bed671dac679af37dcb6e33c07715edf691b10e3bd5c1b2d895fd9459afe67d82eb0f0b3f7b0bfb93de8f27d

  • SSDEEP

    6144:DTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:DTBPFV0RyWl3h2E+7pYm0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b185ee1d0e238b92148737f4a760c681.exe
    "C:\Users\Admin\AppData\Local\Temp\b185ee1d0e238b92148737f4a760c681.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"
        3⤵
        • Executes dropped EXE
        PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe

    Filesize

    344KB

    MD5

    ba6b3e9e7fb1285f73d5afde9acf1b31

    SHA1

    47670254c1e8843ab4f57c03863e55ef2956490b

    SHA256

    484f5e3b627132e8df56b72dd2014b909105674cc4b53a72afe2cd9f2afe17f1

    SHA512

    7342ae9cf0672865f81835fa4a7c208b8d8bdcfbb6640b58417cb8a6b618cad6fda9e3ca9a909eb670e1bb63258f0a7e51b3be33745b02f8f1a9ec202089772c