Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 20:41

General

  • Target

    3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe

  • Size

    40KB

  • MD5

    0dd87583d62fca05908ee79115694763

  • SHA1

    a1e1dc6c13c7ff4d58c3e37b76696ac2c54ebb98

  • SHA256

    3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5

  • SHA512

    c3db458c3a9f0e4295bae9616ecd32a64906290f51493e3c0057b235ddb7cddde1d0f15e73dfa8c04ac987406a384adc2a15a22acce72361ea2e0bb8f43e3cf9

  • SSDEEP

    384:pAcTAjVwMatOwS58YwWdFeaeohweCvklV4Viq1cnD/kQzskH4qA1R4Jgl17:pZTAa/OZj74ybzPHzAtl5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe
    "C:\Users\Admin\AppData\Local\Temp\3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      PID:1884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    40KB

    MD5

    3a6e7d98d3499e3850374f3a7812b8fd

    SHA1

    2a47bf03e9b9f8cea4615df5ea18d2f70b95fb86

    SHA256

    913f3c22c1063110f070e8a9cc032887559865f8af44308c965d0bb9f5665463

    SHA512

    3c63625de9c775c2a8214eaee1d8b9adf8c4924b70dd6934c8da04cc95058105d59948ff8df7dc6a19090aababac233e63b8e42c0b7223950c7e0b1d3ffa4d0f

  • memory/1152-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1152-2-0x0000000001DE0000-0x0000000001DE7000-memory.dmp

    Filesize

    28KB

  • memory/1152-1-0x0000000001E10000-0x0000000001E11000-memory.dmp

    Filesize

    4KB

  • memory/1152-7-0x0000000002C30000-0x0000000002C38000-memory.dmp

    Filesize

    32KB

  • memory/1152-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1884-11-0x0000000001CE0000-0x0000000001CE1000-memory.dmp

    Filesize

    4KB

  • memory/1884-13-0x0000000001DF0000-0x0000000001DF7000-memory.dmp

    Filesize

    28KB

  • memory/1884-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1884-17-0x0000000001DF0000-0x0000000001DF7000-memory.dmp

    Filesize

    28KB