Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/04/2024, 20:11

General

  • Target

    2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe

  • Size

    668KB

  • MD5

    aa92ad095229171fc1b4209798ff4d1c

  • SHA1

    3d1715c146d3b5d57f583eebb91a964242b7cc0d

  • SHA256

    2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0

  • SHA512

    c815529b71762a9f3c95e577d602a0d39ae0e8aa640fac058e4f4be50104a5198c31679ad92263b9e367e71bb3c9a702850621da8e9bac9cc588515688237ec7

  • SSDEEP

    12288:UWBm+95nHfF2mgewFx5zPooWlU1kfgjdkAZgewF:UWBz95ndbgfx5LUgjTZgf

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe
    "C:\Users\Admin\AppData\Local\Temp\2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\2424.tmp
      "C:\Users\Admin\AppData\Local\Temp\2424.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe DFC282AFA51EB457A9BF88DB8FD805A02766954A2B4E6B327D45F7D604FF8535EA0D9FA8B99499AE6C898C78B239B9090339506875D94E664234EC4A31E0C69E
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\2424.tmp

    Filesize

    668KB

    MD5

    067de7c6a9354740c7b0effceb08d3a5

    SHA1

    996692b6ec3d4f3ac1e23cd23c85d64b070e8f62

    SHA256

    cf26d72c66c878e5f23155313466ff4abee633a5e4a323e7e2958c818d80f4b5

    SHA512

    8399d7927b1ac1969de4eea259ae8dc2a78ad1a93041a4edba69bd9fc647c4ede40bd2c812850693f913410161e54b051c80cb9793b40c13afa77c412d87eb33

  • memory/1944-8-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/1944-11-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2164-0-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2164-3-0x0000000001DD0000-0x0000000001E86000-memory.dmp

    Filesize

    728KB

  • memory/2164-9-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB