Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    21s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2024, 04:56 UTC

General

  • Target

    f21ccf98dc32f79b995858aef6396f60d678865717597e699c8be1fb920adb5f.exe

  • Size

    497KB

  • MD5

    1302a044621104433f3c50b46648d898

  • SHA1

    162750d2fc2491c113ab85c5e8dd2e3ce773c9ee

  • SHA256

    f21ccf98dc32f79b995858aef6396f60d678865717597e699c8be1fb920adb5f

  • SHA512

    9d43417f19e7a10b2d719ab9a97a055da1214d801651754b5bba136bb968174987c14d16bb39365b8ec689e0db09424e9ff860ba9c79c6b207ed27de9c38ec29

  • SSDEEP

    6144:J89MAPjz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayu:+b1gL5pRTcAkS/3hzN8qE43fm78V6

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f21ccf98dc32f79b995858aef6396f60d678865717597e699c8be1fb920adb5f.exe
    "C:\Users\Admin\AppData\Local\Temp\f21ccf98dc32f79b995858aef6396f60d678865717597e699c8be1fb920adb5f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2108
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\dev1239.tmp!C:\Users\Admin\AppData\Local\Temp\f21ccf98dc32f79b995858aef6396f60d678865717597e699c8be1fb920adb5f.exe! !
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Users\Admin\AppData\Local\Temp\F21CCF98DC32F79B995858AEF6396F60D678865717597E699C8BE1FB920ADB5F.EXE
        3⤵
        • Executes dropped EXE
        PID:2636
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\dev1239.tmp!C:\Users\Admin\AppData\Local\Temp\F21CCF98DC32F79B995858AEF6396F60D678865717597E699C8BE1FB920ADB5F.EXE!
        3⤵
        • Executes dropped EXE
        PID:2528

Network

    No results found
No results found
  • 10.127.255.255:78
    MSWDM.EXE
    46 B
    1
  • 10.255.255.255:78
    MSWDM.EXE
    46 B
    1
  • 10.127.0.255:78
    MSWDM.EXE
    46 B
    1

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\MSWDM.EXE

    Filesize

    39KB

    MD5

    8b4aef2d7b10876bedfc2d94d5bd152f

    SHA1

    a1017d53dcb9407659fc70c27ced4da77d01f33f

    SHA256

    c23788b417a47f7862bca534efe90ca6f2240f34063dc570e32da8bc7083fc93

    SHA512

    5ce19e078e0826f064b224f7e40cc6eca7b65e10bff51fd7bca316efa7b764a9ce208f3a3b86d20bed7f4d682db2c685b4f57508cd7392957dc5473e6068048c

  • C:\Windows\dev1239.tmp

    Filesize

    458KB

    MD5

    619f7135621b50fd1900ff24aade1524

    SHA1

    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

    SHA256

    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

    SHA512

    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

  • memory/2108-21-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2108-30-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2528-26-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2748-12-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2748-0-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2924-29-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2924-20-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.