Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

035bd7a9bb...56.exe

windows7-x64

7

035bd7a9bb...56.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 18:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe

  • Size

    736KB

  • MD5

    d3b83feb3e0158463cfe3d2355edffbc

  • SHA1

    f79c057c1c214b4d7d1a737f7439c83bb01dc314

  • SHA256

    035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56

  • SHA512

    5174b29ab6758401ee873a640e4cec8592a055d45ae2c460caaa073f69965a77c24f4c81416510562fcf4f8b4aaaaaa979ffe677ca4c60a36aff4a27695dc058

  • SSDEEP

    12288:IWBm+95nHfF2mgewFx5AZrfpI3vTckaIw+zZ1kfgjdkAW10iwJZnEIf6qCWpJKtR:IWBz95ndbgfx5QrBIQkHw9gjTW10iwJS

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe
    "C:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Users\Admin\AppData\Local\Temp\483.tmp
      "C:\Users\Admin\AppData\Local\Temp\483.tmp" --pingC:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe 98F089D89C91D6C41D83343E0E5A16101EFCB523338550F2A4194F477872E60F01C0C3B7A9BCF89BD4EBE3D74208C3D183B49D0838EC12E915B6ADF30E1DE942
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\483.tmp
    Filesize

    736KB

    MD5

    e3a3f70582709f27095eab806a91ffd6

    SHA1

    4df0103d0c69588aba952fab525622dcda7a8c3b

    SHA256

    7cf066aed89e34815906175faf97f4a29239b8bde9d0aaaa23e4add5bdaf1db3

    SHA512

    1e1ed63a84a24d406503953917bb5e8f864da263da5a2fac7512e67d5766fef69273c7f7e9c2ecf1dfa84e781a2434e0695c40cf5b93a58db5ad602344604fb7

    Download Submit

  • memory/2392-0-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2392-6-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2960-7-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download

  • memory/2960-8-0x0000000000400000-0x0000000000488000-memory.dmp

    Filesize

    544KB

    Download