Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 02:52

General

  • Target

    beb60ab22c22a8fe1decfce2fd4a31522ee8b73dfd3a9aa2552ee6d56ba13cec.exe

  • Size

    566KB

  • MD5

    b374b0e64ff33a57b82e126cdd9d3be9

  • SHA1

    809ba05a7ad9726258ba56da026daf4e8f1fde02

  • SHA256

    beb60ab22c22a8fe1decfce2fd4a31522ee8b73dfd3a9aa2552ee6d56ba13cec

  • SHA512

    57ee7db02bda8fe9912afbe5403cc77ab4ec9834125ab36599bb98197472198752f704b851754bdd1c24322486bf662dc5548fb618264ce15287f194fd034d4c

  • SSDEEP

    12288:IWBm+95nHfF2mgewFm5aQ9QPlbYbwJc0Ef1kfgjdkA7YdfPgvF:IWBz95ndbgfm56PlYbwu0EwgjT7YdfY9

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\beb60ab22c22a8fe1decfce2fd4a31522ee8b73dfd3a9aa2552ee6d56ba13cec.exe
    "C:\Users\Admin\AppData\Local\Temp\beb60ab22c22a8fe1decfce2fd4a31522ee8b73dfd3a9aa2552ee6d56ba13cec.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\190C.tmp
      "C:\Users\Admin\AppData\Local\Temp\190C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\beb60ab22c22a8fe1decfce2fd4a31522ee8b73dfd3a9aa2552ee6d56ba13cec.exe BA4026C3B5136FD4CA57C049976C1911D88CC66C8C13358CE0C1AF151C9C638294BF32D1543A038310B0A584B6423409FB4945B7ADB3FACCCAAAFAA8CE9255D0
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\190C.tmp

    Filesize

    566KB

    MD5

    0d7d407ec8ec65fe0f5378fef562bb6c

    SHA1

    503438cb350ad5f12ca0d1e700a72434d5cb81f2

    SHA256

    2cdc05b9366946fc783c47d7cf1d350f227d0d19114c34f0f83e297235d2f349

    SHA512

    d123e0eded0f87f12f3a4ba32c27062141cf2da69d37d523290bf0b01ac3f4d55d0d895fb35fa899443a1fe3d5ce543bcf211eb4a0e3464587a24a5c8e17c15a

  • memory/1196-0-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/1196-6-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/2416-7-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB

  • memory/2416-8-0x0000000000400000-0x0000000000491000-memory.dmp

    Filesize

    580KB