Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    19/05/2024, 20:40

General

  • Target

    3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe

  • Size

    538KB

  • MD5

    90aaa10a02176c863eb287bef17bf3b9

  • SHA1

    831883616deb50f70f177f6569d976bc543b393b

  • SHA256

    3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1

  • SHA512

    0eebae9937b6a77dfe85488cf494c5a21f8c2f85a876ef59cad645bd3836d317d646cd902c0895cf15de647832a557ce2e76a0521891d3741030dd17f012313e

  • SSDEEP

    12288:wlbq+h1gL5pRTcAkS/3hzN8qE43fm78V6:Wbq+w5jcAkSYqyE6

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 9 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe
    "C:\Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2096
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\dev2829.tmp!C:\Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe! !
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Local\Temp\3B55C8B4875DB97F10E6A6F85446EE1988054BA8A035231619A3869D73C11AB1.EXE
        3⤵
        • Executes dropped EXE
        PID:2552
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\dev2829.tmp!C:\Users\Admin\AppData\Local\Temp\3B55C8B4875DB97F10E6A6F85446EE1988054BA8A035231619A3869D73C11AB1.EXE!
        3⤵
        • Executes dropped EXE
        PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\MSWDM.EXE

    Filesize

    80KB

    MD5

    68e2b3feafd08549d8065f0d7bdf7428

    SHA1

    33f40e4b8d55ab73d5697f9a89b96451fd684ec9

    SHA256

    0034a4b9e1272561a35b942a07d3cf5b6203f2a43b526f7a3f0bb9597b70cb56

    SHA512

    7c6687f89338b237687c02927df93068e66d684a29ed7726f12fa083f31b9359e63771566e8279d4242e5357e9036d2bd8ecffb839ad6d09270d995e4665935f

  • \Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe

    Filesize

    458KB

    MD5

    619f7135621b50fd1900ff24aade1524

    SHA1

    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

    SHA256

    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

    SHA512

    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

  • memory/2096-17-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2096-31-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2520-19-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2520-30-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2572-25-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2572-27-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2836-1-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2836-12-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB