Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 21:21

General

  • Target

    0d23848def89126e1313672c44c02f07.exe

  • Size

    340KB

  • MD5

    0d23848def89126e1313672c44c02f07

  • SHA1

    d3a7d3b023158b631b24bb1fa1daa18aa7e64c15

  • SHA256

    5fdb64a7a0f92d15693dad8166756353745ec9323b76364986a991283efbbdc6

  • SHA512

    87c95770af94962ab367068f7b81c907e43450a237494198e60746e88c0c354ffe70899391c60d0a3212c08aea1ac7cf93e26ab1fb89ee0b52d31d04ff615e9e

  • SSDEEP

    6144:VFyR9SLkWor+akVC5s/durgm7hv8htqiXkIvaX/m7bfTWaUspmHjYT9oFv6wHH/f:bI9SLkWor+akVC5s/dIdEhtqiXkIvaXr

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d23848def89126e1313672c44c02f07.exe
    "C:\Users\Admin\AppData\Local\Temp\0d23848def89126e1313672c44c02f07.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\vuoav.exe
      "C:\Users\Admin\vuoav.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\vuoav.exe

    Filesize

    340KB

    MD5

    277d0cac2d4f3de917159d2aa1d13a8d

    SHA1

    c713671aecaa5fb93b98512d6f1d4d1004462b47

    SHA256

    9cac77828f85f142f5ca2a355799972d5e57477ecf8be310abe9c7a53ff71215

    SHA512

    b4fa82197847a307a015d4c3453a33b3acd4ba983d643254f02277e6e07d325d2a4c0cb0e2a0159f794f7afc08c50da4d145370b9dece67fc999af2add7094e8