Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19/06/2024, 20:31

General

  • Target

    2024-06-19_ae2863f255bf3743c1b46f72f7573b7b_hacktools_xiaoba.exe

  • Size

    3.2MB

  • MD5

    ae2863f255bf3743c1b46f72f7573b7b

  • SHA1

    e946146f630bcbda27b84212d78f0ab1057bd4c6

  • SHA256

    2988ed74b1814b0d04f80f10edd7bd6b51992963c6d68167df412086f78fd0c3

  • SHA512

    0685a4420c4708ae632ce85f0e4b12ec18f81b48d979d98cc7896cbdb05861384df2de52496564137b875b33bf8452ea09611a8d9e62718900c45586e6a67724

  • SSDEEP

    49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NF:DBIKRAGRe5K2UZJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-19_ae2863f255bf3743c1b46f72f7573b7b_hacktools_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-19_ae2863f255bf3743c1b46f72f7573b7b_hacktools_xiaoba.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7621c3.exe
      C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7621c3.exe 259400131
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 600
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ÅäÖÃ\f7621c3.exe

    Filesize

    3.2MB

    MD5

    a64aaec961850d1618aaedcbe79ce0c9

    SHA1

    1db7b5f3737467bbee19280a5778c7410348db80

    SHA256

    4f00a2f484d05eec67e691e4c8249276889cd0712c4b2e99c345a4f064304dab

    SHA512

    3c8bf2d89c0cbef70335d1d5fdbebf8d29646dd5f4c4f8b17face8b0c10926a270cf0caaaf44bc73185b311d37b7f823d6863d584712e78a2f6d3c58dab6be7f

  • memory/1764-12-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/1764-14-0x000000007542D000-0x000000007542E000-memory.dmp

    Filesize

    4KB

  • memory/1764-44-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/1764-45-0x000000007542D000-0x000000007542E000-memory.dmp

    Filesize

    4KB

  • memory/2740-1-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/2740-0-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB

  • memory/2740-11-0x0000000002A50000-0x0000000002DF5000-memory.dmp

    Filesize

    3.6MB

  • memory/2740-15-0x0000000000400000-0x00000000007A5000-memory.dmp

    Filesize

    3.6MB