Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 19:00

General

  • Target

    15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e.exe

  • Size

    256KB

  • MD5

    e12339e54bc062adc953867e9d871451

  • SHA1

    00b0c13a7febcc2f90ef23d110bef3166c98ed92

  • SHA256

    15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e

  • SHA512

    847b0e561a06ee031002fd29d29d7ead883e3567e51f25a5d5ba07e05bbaf1eb1ed7bb1e2b1313a5a4f39d35872b8e55766f0afaac0247288fe69ffd9ec12e65

  • SSDEEP

    3072:UI0/tfqGL3txR6Nthj0I2aR1DXmaSU+ymHnHxgczwfSZJqsXbnhFkEv:wt5xoNthj0I2aR1zmYiHXwfSZ4sXlF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 52 IoCs
  • Adds Run key to start application 2 TTPs 26 IoCs
  • Modifies registry class 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e.exe
    "C:\Users\Admin\AppData\Local\Temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2240
    • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202.exe
      c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3040
      • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202a.exe
        c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202a.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2644
        • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202b.exe
          c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202b.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2664
          • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202c.exe
            c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202c.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2856
            • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202d.exe
              c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202d.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2360
              • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202e.exe
                c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202e.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2868
                • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202f.exe
                  c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202f.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2340
                  • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202g.exe
                    c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202g.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:2604
                    • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202h.exe
                      c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202h.exe
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2092
                      • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202i.exe
                        c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202i.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:1236
                        • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202j.exe
                          c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202j.exe
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:328
                          • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202k.exe
                            c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202k.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:1264
                            • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202l.exe
                              c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202l.exe
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:2044
                              • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202m.exe
                                c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202m.exe
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Adds Run key to start application
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:2756
                                • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202n.exe
                                  c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202n.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:1680
                                  • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202o.exe
                                    c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202o.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    PID:608
                                    • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202p.exe
                                      c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202p.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      • Modifies registry class
                                      PID:668
                                      • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202q.exe
                                        c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202q.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        • Modifies registry class
                                        PID:1792
                                        • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202r.exe
                                          c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202r.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          PID:1480
                                          • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202s.exe
                                            c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202s.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            PID:2780
                                            • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202t.exe
                                              c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202t.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Adds Run key to start application
                                              • Modifies registry class
                                              PID:2932
                                              • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202u.exe
                                                c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202u.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • Modifies registry class
                                                PID:1492
                                                • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202v.exe
                                                  c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202v.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:1800
                                                  • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202w.exe
                                                    c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202w.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Adds Run key to start application
                                                    • Modifies registry class
                                                    PID:784
                                                    • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202x.exe
                                                      c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202x.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • Modifies registry class
                                                      PID:888
                                                      • \??\c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202y.exe
                                                        c:\users\admin\appdata\local\temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202y.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        PID:1504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202.exe

    Filesize

    256KB

    MD5

    c4b6cb3561345fa147ff59d49929cba4

    SHA1

    1160d4924c1bd340fdf005792635b24ba84b117f

    SHA256

    48fa56d48bf7205c658f48d8b28b97cba8d3ca532b4aadc2398aa02460ef3ed0

    SHA512

    89aa50261fb0396dd0fad4bd392a613e16054b9769d108013c983e7131646c60836400be2a353cba927de3b9fec8aa85f934f6522a0e4f40b3966f1f346b104a

  • C:\Users\Admin\AppData\Local\Temp\15ed745a2d335438f2532331c91da479c6ad06ac383ff27e6d4a95305c11882e_3202k.exe

    Filesize

    256KB

    MD5

    890c7f2925f67da4632c1d8e15ef4009

    SHA1

    f23ef1f7449af872fe49a2fb3aedf6cfb323005f

    SHA256

    2cc7728315c1e6bbf9a58052399cbcefd002e5c90484b6860ef89749cdec8817

    SHA512

    b23a8d6b504a20e8b3c74af65ab293254a56b66a38c23671c765005ee6d5a36758bb91cf92b28d1ee563367b7045394dd6f1d07299e9ecd16c03064e0985a8f4