Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 09:30

General

  • Target

    024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.exe

  • Size

    8.1MB

  • MD5

    670945e3b43ea240cf8569096ffb2448

  • SHA1

    e2f406135c001fbab91b83ba1bdbec06a1e8d404

  • SHA256

    024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c

  • SHA512

    4e348052733e922b24ce4afae3e5df82f5331f45739f9f07d233bcf23417ffb2a0d3b1fc29a9c2d1b0e21ea02a2e927ae17c4f6184ef00bea4fc11294bafef3f

  • SSDEEP

    196608:/cjZ6UFb6kBtyG91o/+TytiQ74tktR4zR:Uk4+WyG91rMp4tyeN

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.exe
    "C:\Users\Admin\AppData\Local\Temp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\is-6JAGI.tmp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6JAGI.tmp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.tmp" /SL5="$4010A,3701387,791552,C:\Users\Admin\AppData\Local\Temp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Users\Admin\AppData\Local\Temp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.exe
        "C:\Users\Admin\AppData\Local\Temp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.exe" /VERYSILENT
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Users\Admin\AppData\Local\Temp\is-H0LQK.tmp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-H0LQK.tmp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.tmp" /SL5="$5010A,3701387,791552,C:\Users\Admin\AppData\Local\Temp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          PID:2036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-6JAGI.tmp\024ae42a8039ed6ca3cdb39d271ac9be203f9f46c83ba65c786b092a8f8b420c.tmp

    Filesize

    3.0MB

    MD5

    e30a9c05f7c2db3d38abfded7f96fbe7

    SHA1

    6648229622e1351deac0ca7f69eed8281e77bbd9

    SHA256

    a5da47dd0afdceae1525713d77427d00735e6fcbf035db6e8fe981ca2df2d285

    SHA512

    20164e6ebc80cb81d25353b7d59c348ea19efac9be22d4f764748869d505728e1459e6bcc4134941465c44f5ca69fffaf3f4980895bd62edee5a80b285067216

  • memory/1696-9-0x0000000000400000-0x000000000070A000-memory.dmp

    Filesize

    3.0MB

  • memory/1696-14-0x0000000000400000-0x000000000070A000-memory.dmp

    Filesize

    3.0MB

  • memory/2036-29-0x0000000000400000-0x000000000070A000-memory.dmp

    Filesize

    3.0MB

  • memory/2520-11-0x0000000000400000-0x00000000004CE000-memory.dmp

    Filesize

    824KB

  • memory/2520-31-0x0000000000400000-0x00000000004CE000-memory.dmp

    Filesize

    824KB

  • memory/2972-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

  • memory/2972-0-0x0000000000400000-0x00000000004CE000-memory.dmp

    Filesize

    824KB

  • memory/2972-16-0x0000000000400000-0x00000000004CE000-memory.dmp

    Filesize

    824KB