Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/04/2024, 12:45

240417-py47wsff45 10

17/04/2024, 12:45

240417-py3n3ahb5z 10

17/04/2024, 12:45

240417-py23jahb5x 10

17/04/2024, 12:44

240417-pyxg2sff35 10

17/04/2024, 12:44

240417-pyw7aaff33 10

17/04/2024, 06:12

240417-gynk5sff65 10

Analysis

  • max time kernel
    1799s
  • max time network
    1568s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 12:45

General

  • Target

    382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe

  • Size

    84KB

  • MD5

    eeaeb64b80465d155e7c53858de7761c

  • SHA1

    5c1e8a6783c4db3e331103e86dd4383ed1a8286f

  • SHA256

    382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd

  • SHA512

    f69885e932515cbdf94556fe19f447fc5b530f41eed64e12bf7efcfb3761ef15a1d3e88248ae4aa288bef25cd70b3a88611e2671e21ae64da3d78fc6f4bed188

  • SSDEEP

    1536:Gh/3/Qo5qRJvMo23MPM8MDyR1CaVHob64SPy6bgMuqDqkyJcFh:Gh/Xj4R1RVHoWrbfuaqk/F

Malware Config

Signatures

  • Windows security bypass 2 TTPs 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe
    "C:\Users\Admin\AppData\Local\Temp\382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\30701146433628\audiodg.exe
      C:\30701146433628\audiodg.exe
      2⤵
      • Windows security bypass
      • Executes dropped EXE
      • Windows security modification
      PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \30701146433628\audiodg.exe

    Filesize

    84KB

    MD5

    eeaeb64b80465d155e7c53858de7761c

    SHA1

    5c1e8a6783c4db3e331103e86dd4383ed1a8286f

    SHA256

    382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd

    SHA512

    f69885e932515cbdf94556fe19f447fc5b530f41eed64e12bf7efcfb3761ef15a1d3e88248ae4aa288bef25cd70b3a88611e2671e21ae64da3d78fc6f4bed188

  • memory/1924-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1924-6-0x0000000002CF0000-0x0000000002D18000-memory.dmp

    Filesize

    160KB

  • memory/1924-9-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2724-8-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2724-11-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB