Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 00:01

General

  • Target

    a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe

  • Size

    32KB

  • MD5

    8c193a8f0c706fd5901f7a0cb5654e3d

  • SHA1

    a0b59b32047808ec9fec8eed11196deeecd9d46f

  • SHA256

    a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1

  • SHA512

    9d0e36346584cb94af6db85528dfafac9922499f03860595fe88afe2daa5b1bcba1cd4a51dfaf1dcf29fe56e07d39816428642961552f99a0c23a88f801cdc5c

  • SSDEEP

    384:Q98xUHQGTRO9mIy4Ng8zLeiQerUSreM1wRZn5jUa+jm71T+eE1DiRMECQv/Swg:Tw3TRid/gopVrDDa+jO1T+/1sCwSwg

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe
    "C:\Users\Admin\AppData\Local\Temp\a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
      2⤵
      • Adds Run key to start application
      • Runs .reg file with regedit
      PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\RCX1B9D.tmp

    Filesize

    32KB

    MD5

    b0dab109cb6bebaeaedd87a430a9cf97

    SHA1

    32574dfef7946bdd551fb29511444c1cd816e85e

    SHA256

    0a6de028b0956ced750c7283105aabaf8db111ec650d48980ded7a4e3f293bdb

    SHA512

    27103cbda01ffe2eee413be350145fdd6bc8d94066e14eae21a074839576dc7f880711d5dfdf5dc48096b00c64663e2aaa0ad54838b39a9ca5506f80053fa93f

  • C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

    Filesize

    164B

    MD5

    5b70d696d5cf6dc97150c200262d95cf

    SHA1

    374eeb8811bb6d0cfa31b70974d9fce39cf5a90e

    SHA256

    ebb66003c71a7b1a9e1dfcbb2e9791e87fd7b57b53b2795e21419828cbee95e7

    SHA512

    371b96751b4b2ff785c44042f0b579f903a42594e2e32c1271f0fab7393a70bc1ea02396596ed8a8959266ce045df578a7bc634c77cd2c04a81784e058cd5bac

  • memory/2916-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2916-1-0x0000000000020000-0x0000000000028000-memory.dmp

    Filesize

    32KB

  • memory/2916-3-0x0000000000020000-0x0000000000028000-memory.dmp

    Filesize

    32KB

  • memory/2916-12-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB