Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 21:42

General

  • Target

    632f3be52177e4af973da008764aafea7e2f574e03f7bfbe819e6d71e4d1fb8b.exe

  • Size

    94KB

  • MD5

    31840277debf80145d774069fb81059b

  • SHA1

    30c611d7c77849527d1c5350749060c3ad6ba3e2

  • SHA256

    632f3be52177e4af973da008764aafea7e2f574e03f7bfbe819e6d71e4d1fb8b

  • SHA512

    11cc6f0e5bcfa2c571c2556b8ea6e95dfc50cd3cd8f6b32be12fcb185a8077bcdb038d1e6b87e809d9ab010ea3c9e2f4037653303ab533590f28cfb8466a3f85

  • SSDEEP

    1536:/Ao0+j2d6rnJqlIUSJn3m2GnNCyuaMeFg8kVQ+SvMupWsZZZNF01Lryhv1g1s1EY:/AoVl4lXin3m2GnNCyuaMeFg8kVQ+Svf

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\632f3be52177e4af973da008764aafea7e2f574e03f7bfbe819e6d71e4d1fb8b.exe
    "C:\Users\Admin\AppData\Local\Temp\632f3be52177e4af973da008764aafea7e2f574e03f7bfbe819e6d71e4d1fb8b.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:2036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    94KB

    MD5

    97bcb74added632dd8bab0c9054acfb4

    SHA1

    563444c17bd5257f2659f17eaf73f6a9e84c29c7

    SHA256

    23edf1c911b190d1a4b31154c9cc0843073ce3149c47d4ce6cdc1066819426dc

    SHA512

    f179f36e300e099a5bbcc76443fdd3a33408e143647c5d8f7fabbf527e518f5910ecd1c915928d81b61dcc16f61d52e52f64e274866ea64d9f3d6e410981c137

  • memory/112-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/112-7-0x00000000002A0000-0x00000000002AD000-memory.dmp

    Filesize

    52KB

  • memory/112-6-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2036-9-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB