Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 11:48

General

  • Target

    $_3_.exe

  • Size

    1.8MB

  • MD5

    77bfacca17ee1d89833b57f3a746d9a0

  • SHA1

    aa9490c913489c5eafd02f67f875efcb56d23036

  • SHA256

    38571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52

  • SHA512

    21ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f

  • SSDEEP

    49152:/SNY8H0ZGF5j51XdQTPRPgojx1NslvUOl/WkMWAH:oY00Z8F1XdUL

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$_3_.exe
    "C:\Users\Admin\AppData\Local\Temp\$_3_.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\3822.bat" "C:\Users\Admin\AppData\Local\Temp\BE9772138E464D02B9612D0875D42C71\""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 1 -w 1000
        3⤵
        • Runs ping.exe
        PID:984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3822.bat

    Filesize

    214B

    MD5

    739fcc7ba42b209fe44bea47e7a8c48f

    SHA1

    bc7a448a7c018133edcf012bc94301623eb42c5b

    SHA256

    69017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c

    SHA512

    2b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a

  • C:\Users\Admin\AppData\Local\Temp\BE9772138E464D02B9612D0875D42C71\BE9772138E464D02B9612D0875D42C71_LogFile.txt

    Filesize

    9KB

    MD5

    0fb3111e9310017adb5ff83b155a947d

    SHA1

    630586ceedfdf46a224e81d59a87721d69fafab6

    SHA256

    b23e58256de638887c25d48d8da248ddea5986ee22be2fdb59bc8e6448ecf69b

    SHA512

    857ff8f6f7f376084c78e3e0d0fa776f847998f6a7eece8965ba190c53e1d960db53c38b2c30cff04b869a4a5270764e59f94dfe7acbd5cc81107ce687ac7344

  • C:\Users\Admin\AppData\Local\Temp\BE9772138E464D02B9612D0875D42C71\BE9772~1.TXT

    Filesize

    110KB

    MD5

    e6d99c69f61773b8e861941d7ead58f0

    SHA1

    8854806d070b8889fb2f5877441c4ceeeb863a6c

    SHA256

    223f574cf7dd38b0b77a7bac8a54007547635bcc823e555d5463af339ca47217

    SHA512

    704ddacec5c6147d7983ee4c49b1e8e155bcf6a7e19e0122e3e1738815ef0a3d62e4b059b350bb00c466ece277168e999d11c57db22ba1edfce82167139f714e

  • memory/2304-63-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2304-184-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB