Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 18:15

General

  • Target

    052afe5a2734aec7ab6c4e3e847f322ff11e7ed63a85baa9b185dbbbb658a089.exe

  • Size

    233KB

  • MD5

    aff74fbea0ac732b034d9d3bc4101f7d

  • SHA1

    8c215ddebba01f0c63fba345b33f2cdfbc7c5bb0

  • SHA256

    052afe5a2734aec7ab6c4e3e847f322ff11e7ed63a85baa9b185dbbbb658a089

  • SHA512

    491ad0086ad4cdd22bfebc06ac7bfc1a934fb6f1def034e7744bf0026c76f7662f21c931baf1fcc0b3184596a7a8bd1e9fb120281279f9b3c3b2150c248ef0a8

  • SSDEEP

    3072:1xGcwApj6FHzId1WmJ+UrdoI5iCCWm2x5wa3ny/7LsMaP8TxaTYe:1xxpjAHzId1MUeI4CdRYa3ny/7mP88

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\052afe5a2734aec7ab6c4e3e847f322ff11e7ed63a85baa9b185dbbbb658a089.exe
    "C:\Users\Admin\AppData\Local\Temp\052afe5a2734aec7ab6c4e3e847f322ff11e7ed63a85baa9b185dbbbb658a089.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:3024
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E78D1E7E-674B-429F-AB9C-3430F23C017E} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\PROGRA~3\Mozilla\xobykzk.exe
      C:\PROGRA~3\Mozilla\xobykzk.exe -clyupje
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\xobykzk.exe

    Filesize

    233KB

    MD5

    e7d9c85911ddef9c8a6689a2502c1f59

    SHA1

    49f8fa5f1b72ff76a818a056fad706d4c472b69f

    SHA256

    13575da0e77a7e764503dcb592b7f4bf42b9f260bae2ce45e0caf43c2eb6d398

    SHA512

    40a9c8f98a9bef9770933ec8f753fbf367bdf14371b673d5313fb25bf9b724e7807aa70a797b6b4d03cd8c5cdfc406fff29961d3af57a8b0c834a5ec918db134

  • memory/2052-7-0x0000000000460000-0x00000000004BB000-memory.dmp

    Filesize

    364KB

  • memory/2052-8-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2052-10-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2052-11-0x0000000000460000-0x00000000004BB000-memory.dmp

    Filesize

    364KB

  • memory/3024-0-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/3024-1-0x00000000002C0000-0x000000000031B000-memory.dmp

    Filesize

    364KB

  • memory/3024-2-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/3024-4-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB