Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 16:32

General

  • Target

    virussign.com_5d049dc061483a053d31349dda6ce4a0.exe

  • Size

    58KB

  • MD5

    5d049dc061483a053d31349dda6ce4a0

  • SHA1

    ff81ad577ac388542e87000829e425ea3e23e22e

  • SHA256

    2e7e2b430145b75f8c2c28dd0db907019a5d278ce488cc82ccf875433df33c48

  • SHA512

    e00b2c5df4ceb5091572e7a739d67c0ccaffe4ce8b1ace96c5061fb327c68e3a8daed85baac045f3a12bdc826cfaca0494d00f94fca714a85bd84f180180c0a6

  • SSDEEP

    768:9qSqC8+N5ozQQRncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtSqkl:9rqfzQQRamN8835mv7CUroqkl

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\virussign.com_5d049dc061483a053d31349dda6ce4a0.exe
    "C:\Users\Admin\AppData\Local\Temp\virussign.com_5d049dc061483a053d31349dda6ce4a0.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Program Files (x86)\3551d1c\jusched.exe
      "C:\Program Files (x86)\3551d1c\jusched.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\3551d1c\3551d1c

    Filesize

    13B

    MD5

    f253efe302d32ab264a76e0ce65be769

    SHA1

    768685ca582abd0af2fbb57ca37752aa98c9372b

    SHA256

    49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

    SHA512

    1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

  • C:\Program Files (x86)\3551d1c\jusched.exe

    Filesize

    58KB

    MD5

    7b5968a5fa40f06e12117d9e27bbbbe7

    SHA1

    23fc8e97c308f24380c08e5d085e85bce068b397

    SHA256

    3026b00c3bbc47def206ba8d0a02c4eee0cae216aa6d9d0d2ff3edac15b7ebd3

    SHA512

    ded3c600221b498153471869e033797d2496c77a79c6932d2d2ef4a38670034889a741e8f48c2ee139506276367351a2b0b66622675b87c2c0ad1216d00f9ee1

  • memory/2300-0-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2300-3-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2300-5-0x0000000000401000-0x0000000000406000-memory.dmp

    Filesize

    20KB

  • memory/2300-4-0x00000000001B0000-0x00000000001B3000-memory.dmp

    Filesize

    12KB

  • memory/2300-17-0x0000000004900000-0x0000000004944000-memory.dmp

    Filesize

    272KB

  • memory/2300-16-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2300-15-0x0000000004900000-0x0000000004944000-memory.dmp

    Filesize

    272KB

  • memory/3012-22-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/3012-19-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB