Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 22:53

General

  • Target

    79656d27a101f43221cf47c33d36c984e0b0c6a0699a1433d5fbeeef7eb77183.exe

  • Size

    320KB

  • MD5

    a121a17e533b1855b8942025d6a8fb61

  • SHA1

    935ddfe88d0449877ebf9e058883f917a331432f

  • SHA256

    79656d27a101f43221cf47c33d36c984e0b0c6a0699a1433d5fbeeef7eb77183

  • SHA512

    53bd0bab6aa6f0779bf500aca1dc25245671e83c920476adec522147e57ad0e9a4fe90441557a458c3e6259f63702c789496865973467613cecaca13b337c303

  • SSDEEP

    6144:KQFNjeCCCCKb9EMU/NELJjaMOJZitfXzV40saiigCz:KQFJnCKhG1UJmMQZitfzVQ5zCz

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79656d27a101f43221cf47c33d36c984e0b0c6a0699a1433d5fbeeef7eb77183.exe
    "C:\Users\Admin\AppData\Local\Temp\79656d27a101f43221cf47c33d36c984e0b0c6a0699a1433d5fbeeef7eb77183.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\79656d27a101f43221cf47c33d36c984e0b0c6a0699a1433d5fbeeef7eb77183.exe
      C:\Users\Admin\AppData\Local\Temp\79656d27a101f43221cf47c33d36c984e0b0c6a0699a1433d5fbeeef7eb77183.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\79656d27a101f43221cf47c33d36c984e0b0c6a0699a1433d5fbeeef7eb77183.exe

    Filesize

    320KB

    MD5

    e266e85dca84feb0e818c577f5644d0a

    SHA1

    2800b054ebfc44c41b0db2c63a2943a7f0e97114

    SHA256

    3a95887e4f30db4494d5c3fe4d24610d69b289faff14df26c058381a69c7ad59

    SHA512

    c23d82f38d527063d325e4ab76c98f2e76f123c5ac34ed1cb9d98bdda1bfb84246acddd01eee41d8282ead65f87a5c099687406756ecaffd9dab14c1d7bb61b9

  • memory/1728-11-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/1728-12-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1728-17-0x0000000000130000-0x0000000000170000-memory.dmp

    Filesize

    256KB

  • memory/1972-0-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/1972-6-0x0000000000130000-0x0000000000170000-memory.dmp

    Filesize

    256KB

  • memory/1972-10-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB