Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 01:07

General

  • Target

    05ea1a045547b1590f3ae863606023e0.exe

  • Size

    534KB

  • MD5

    05ea1a045547b1590f3ae863606023e0

  • SHA1

    8de6083da38e2e13e50833bb799c693d0499836e

  • SHA256

    5018cca1e4040dea39a15efe9ec4d183076a9500f5903d1edf5c6b7922e12c38

  • SHA512

    73d0469394b0d90825052ca40a594dac0e591360311af78b190ed919408b86c0aa1dfc207c9cfb907d7a48a0a6af7ca9b539ba4013b57deeab1788e5ee8abdb1

  • SSDEEP

    12288:zWBm+95nHfF2mgewFE5reJydqMPS/Q6t1kfgjdkAsSOs:zWBz95ndbgfE5AmPSoVgjTsSOs

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0.exe
    "C:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\A2E.tmp
      "C:\Users\Admin\AppData\Local\Temp\A2E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0.exe 6AED77EEC6EFCE7408AAF0952D401554BCBDD4EA3BD721C0B7470680116F3C1692ABCB60B7E2887BA0E452AF5AC98F8FA0CED9E743DF92DDE7575CD72FAD9CBF
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\A2E.tmp

    Filesize

    534KB

    MD5

    05e3ca1ceaf7a164647c1fd5694374e1

    SHA1

    0e6b8112554bf9b7472a3c40262abe55794f7974

    SHA256

    b39cc60626b0dc411bfae37b3664a1445108389022fba1dff526ea593d475170

    SHA512

    777b2be630be11b5b01417855e74b7f46ef058b92eb6c09fd6a3cf05efeafc9dbd3567383447f91e1fc646a331b5c04e9a18cfb467f8e47db5397dd7fc311a33

  • memory/1612-0-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB

  • memory/1612-4-0x0000000001D90000-0x0000000001E1F000-memory.dmp

    Filesize

    572KB

  • memory/1612-7-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB

  • memory/2980-8-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB

  • memory/2980-9-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB