Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 20:09

General

  • Target

    303674c4d93c77c5ce80eb2e48b78ae630d2601455750da1015f677709b9fc35.exe

  • Size

    49KB

  • MD5

    a9c6d4cfbbf823ec59dc04c1e18f1662

  • SHA1

    208435a037c6aca22bd914f9fdf01834f89e0f2c

  • SHA256

    303674c4d93c77c5ce80eb2e48b78ae630d2601455750da1015f677709b9fc35

  • SHA512

    294e0da4037543d7b245b6ff29b58d442544ad28b3f94b08ac5dd86d4a30136719a04e71535be1770c49647d4fd2b598fe3144f9ecdc2be817e95f98c282e46c

  • SSDEEP

    384:CITpZpCV7gLRUQZ4zkeys3LptCdAX7iMX/UO1KwrL1yS3:LTnpCWRDyoe9pX75vKcLAS3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\303674c4d93c77c5ce80eb2e48b78ae630d2601455750da1015f677709b9fc35.exe
    "C:\Users\Admin\AppData\Local\Temp\303674c4d93c77c5ce80eb2e48b78ae630d2601455750da1015f677709b9fc35.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\hfdfjdk.exe
      "C:\Users\Admin\AppData\Local\Temp\hfdfjdk.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    368aae1640d2c2c818c78ece1a5e8d71

    SHA1

    8dec9cef58b7e4f8ecc6ba6907f1257e19555988

    SHA256

    d0de3db8bc422e27c23cd8cfb569da1b1f10657439a6886ba750796a5cb6817b

    SHA512

    677aff7cbef5711bee9c0748c7dc95c97cf352f9d9906f4cedfcb03dac1c8e65d56d30a76c76e8852c84c7fd033a26e3aa3bf51dfe46828406ac77cf7e8b6698

  • C:\Users\Admin\AppData\Local\Temp\Cab11ED.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar138A.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\hfdfjdk.exe

    Filesize

    49KB

    MD5

    fcb7c200396e314092ad733769e772b8

    SHA1

    6492cdde294167bf994dd8cccde00cc037788681

    SHA256

    6f0ccaed3fa75acc10d3a3a0e047c5ff61a4f65cac693fbc28703a89b76c9df0

    SHA512

    e59565ad8bdc74438d71f788aa0a1ff93e5e1ac581c87ea82ff59f4d53f75eecb231da256095eec53639d57b708d57d454d8b73c16494f01065e6add3a8b8250