Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2024, 14:04

General

  • Target

    255bbe0a32256eced328d38e936ec7388e4d6770529df661f1ffa9e4dc746190.exe

  • Size

    328KB

  • MD5

    47f3bc9a62d7d67357e6b500615865d4

  • SHA1

    1ab49a5c9d0234efb37b338a1da4957b18eca5bd

  • SHA256

    255bbe0a32256eced328d38e936ec7388e4d6770529df661f1ffa9e4dc746190

  • SHA512

    436655cdb6953d497c665ff0a936ee4d0a2367d040c54633c882b63b8684fdb2f0587ba930e4e7408e7c1733e132c937e4893d940526d02105a40a51463b036f

  • SSDEEP

    3072:xANA6IMfSLilGMXEVP79SE8pve/RysNPDuIvT4FBDv1KS2jbxWGqJs3:WiMF/X479SEAanPSIv0FB5KSbGqJs

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\255bbe0a32256eced328d38e936ec7388e4d6770529df661f1ffa9e4dc746190.exe
    "C:\Users\Admin\AppData\Local\Temp\255bbe0a32256eced328d38e936ec7388e4d6770529df661f1ffa9e4dc746190.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:2372
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0A095DC4-E200-4C38-9C37-C3FF634AB7BA} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\PROGRA~3\Mozilla\anhxrcb.exe
      C:\PROGRA~3\Mozilla\anhxrcb.exe -wxojhrj
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\anhxrcb.exe

    Filesize

    328KB

    MD5

    a4bb2dd8802cd54a3948aa2a2026e622

    SHA1

    a47b7168c083ccfc06200ed75aa4208f494d6b19

    SHA256

    392ba5f41bc98ced0432e70a002bb88df0ac6118615999cd53671c60c03b6ee1

    SHA512

    856fc7e2f96a9ee7bc5f9eee2059c2ca522a056fa44807a0ad004951c3582d552521aadd741f63ecc4bddbecc6242df6835f516f64ca2bbe20be573e617f5e4f

  • memory/2080-7-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/2080-8-0x0000000000360000-0x00000000003BC000-memory.dmp

    Filesize

    368KB

  • memory/2080-9-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2080-11-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2372-1-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2372-0-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/2372-2-0x0000000000470000-0x00000000004CC000-memory.dmp

    Filesize

    368KB

  • memory/2372-4-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB