Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04/05/2024, 02:44

General

  • Target

    c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe

  • Size

    416KB

  • MD5

    65002ed754758a8927f543f837326dc8

  • SHA1

    10963660bb3910059c2889e909949fdd5b731336

  • SHA256

    c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76

  • SHA512

    ae8450e0d18e91fcea298dd11665758681527fbc424a3194e8d5304be4db9db2a4650d9e33e9b4fa224a33cbe548402ed3cbfd4119ba4b742d0b8cbf151c4956

  • SSDEEP

    6144:zMmCFy+ziioMX/a7Sj8V79H0W7cyqCxSngmMBqfycuPbUl0i5cD5J6KE:zMmezrX/jIV7j0npM4dl0v5JdE

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe
    "C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe
      C:\Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of UnmapMainImage
      PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\c5bd0af1e6360c9a9fa695740595c96541bc89db5c19c7ecb5f0b299c9a95a76.exe

    Filesize

    416KB

    MD5

    7b6ad3e920f4947a7a76a14fcbfc5d6b

    SHA1

    9e115eaab36fbf8663276ceaa5557ac4c53721e3

    SHA256

    26858481034c9078d1472e8b64a86d075432895ae287f64c7259ec72f4396df9

    SHA512

    23a742f85e21c9c83e1ab52fdc4c2df8a54676c956b4cb489fae43dc27c2204ce1c11e04977c1c50f8a4fa872deb3466d766b3e376069affc80de6d7a7be11f0

  • memory/2632-10-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2632-11-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2632-16-0x0000000000130000-0x0000000000171000-memory.dmp

    Filesize

    260KB

  • memory/2916-0-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2916-9-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB