Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/04/2024, 01:58

General

  • Target

    bb1b35c3be65e6153417c19da61b18dd03668a1da5fe66079f616c31776d0253.exe

  • Size

    228KB

  • MD5

    843c386b2f9c00319fb64480198726a4

  • SHA1

    a661891a1c2053cfe7eed6c1c6da5c47599df1b2

  • SHA256

    bb1b35c3be65e6153417c19da61b18dd03668a1da5fe66079f616c31776d0253

  • SHA512

    75ea78a4dbedba99547347f9f18468921a90fc1e28ad0faad3cea7abc4d4e66b12352ca1f259e8c4382b1eae6e8d621661ea5424f6ff5b15909e0a4499eebd6c

  • SSDEEP

    6144:LEW3PFKs7aaOKW8alhrEqxF6snji81RUinKGHgDTF:LE0PhvENPH6B

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb1b35c3be65e6153417c19da61b18dd03668a1da5fe66079f616c31776d0253.exe
    "C:\Users\Admin\AppData\Local\Temp\bb1b35c3be65e6153417c19da61b18dd03668a1da5fe66079f616c31776d0253.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\wuupo.exe
      "C:\Users\Admin\wuupo.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\wuupo.exe

    Filesize

    228KB

    MD5

    e3a4d1cf9a9e2bd6ea5348890ebd9974

    SHA1

    3af6bf385be4519c91b47bdad43c2b3cad8a79e6

    SHA256

    7cc13c842e344ca079c511057482dfd5aa8f7644e9a8afa38f4d5d0c35f4cb29

    SHA512

    44c94f0e53dd489f6c78cfa4c4aa909d209db7c24dac2853de3de14b51aeb9fca1028106e81e3b1f825f98442be09600d2efeaa437a8d383866fab035b7b8f66