Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/03/2024, 00:09

General

  • Target

    d76c13deb1fa0aee56da0a207a305346.exe

  • Size

    8.7MB

  • MD5

    d76c13deb1fa0aee56da0a207a305346

  • SHA1

    17fb0bbf0886971a77796e72dfa6d7982194751d

  • SHA256

    63084033854552381a7e17b02c46d0759bc519ca55852ad4b58c216e82155645

  • SHA512

    f6b6cb5bd1bc6fa4714b592f18f940d9eb1ea2de22addd997eea05a31da28253bdb792d24e8d172a024e28769fa86fa0ea6ec8b52740af75c51c058c3ed40510

  • SSDEEP

    98304:qYezaAa0aVaN8oxyzcBpKc1IOkEXnkoV6KdcPhk0SgUvFJI+amPZg369Ibi:qYezP3MW8oxywg0ky6W+dUv7

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d76c13deb1fa0aee56da0a207a305346.exe
    "C:\Users\Admin\AppData\Local\Temp\d76c13deb1fa0aee56da0a207a305346.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 mswinsck.ocx
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\mswinsck.ocx

    Filesize

    106KB

    MD5

    3d8fd62d17a44221e07d5c535950449b

    SHA1

    6c9d2ecdd7c2d1b9660d342e2b95a82229486d27

    SHA256

    eba048e3a9cb11671d0e3c5a0b243b304d421762361fe24fd5ea08cb66704b09

    SHA512

    501e22a0f99e18f6405356184506bc5849adc2c1df3bdee71f2b4514ab0e3e36673b4aecbd615d24ebb4be5a28570b2a6f80bd52331edb658f7a5f5a9d686d10

  • memory/2980-0-0x0000000000400000-0x0000000000CC3000-memory.dmp

    Filesize

    8.8MB