Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 00:00

General

  • Target

    a4c9765694c14c76a16840d6d85733007009e6b0f34fc496411ae50fbe2e18b1.exe

  • Size

    138KB

  • MD5

    37575b8427091d362df9171a320c831c

  • SHA1

    f619184c210ba6bd786ee9a3e7ed64b44cf6ad74

  • SHA256

    a4c9765694c14c76a16840d6d85733007009e6b0f34fc496411ae50fbe2e18b1

  • SHA512

    c1e2bf2699838c78777b9e403c1c2c06cbeaefb4903a2941acedb350a83ddf76bef107bb58ff68652010b2a8124d31ab4ec06760dfa476a3a4a2bc4a37da3f0e

  • SSDEEP

    3072:PSQoAIRBiqAoZz6ix08+yQLaldH6AkR3ivgipBI0S9xTV:6yIRBixoZOiuyOQdHeR3ivgip9St

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4c9765694c14c76a16840d6d85733007009e6b0f34fc496411ae50fbe2e18b1.exe
    "C:\Users\Admin\AppData\Local\Temp\a4c9765694c14c76a16840d6d85733007009e6b0f34fc496411ae50fbe2e18b1.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1632
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {9492E525-2B16-4E65-AAD9-2D5B0F235069} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\PROGRA~3\Mozilla\gjsfhjk.exe
      C:\PROGRA~3\Mozilla\gjsfhjk.exe -tuxiydl
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\gjsfhjk.exe

    Filesize

    138KB

    MD5

    3e95480efa3aaa7cf693a1159a5b7c28

    SHA1

    92995ab5d90c382891e1faee1229dd45340acf6f

    SHA256

    350f5f1da67631d40c237a61834333dc46948d40721db83cf5aad00ceed7e9c3

    SHA512

    dd57cb9c0862cedbd28f0f757e406f2ac96c630479964c4bb943f0fee27c2fe110eab4416473124e047e687237e85bc32e8f32ee93b9761c4b01363ce908a287

  • memory/1632-0-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/1632-1-0x0000000000250000-0x00000000002AB000-memory.dmp

    Filesize

    364KB

  • memory/1632-7-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/2612-10-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/2612-11-0x0000000000D40000-0x0000000000D9B000-memory.dmp

    Filesize

    364KB

  • memory/2612-17-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB