Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    23/06/2024, 22:41

General

  • Target

    6c4f48a92a88dd72d6e92aaaebb8d674ca6bb3263999bda5d663791f89d28e9f.exe

  • Size

    256KB

  • MD5

    a735f1c4d0b1a8f8a57b9f6cc21c4d5d

  • SHA1

    ca2f6b0b9f35bfd3342c041dbcae64e55df2197f

  • SHA256

    6c4f48a92a88dd72d6e92aaaebb8d674ca6bb3263999bda5d663791f89d28e9f

  • SHA512

    0c221c8a437cd267dccd8b31a50851bc292fa9d772b4e9f63f76997c3dc0b91c90c17399c9719e40fe15ee6d15af02e3194f95e45684f6c0ddbaed11272f3970

  • SSDEEP

    6144:aBWIqEf6AAlZVZdLS+8Zg6S1dqShh2+SZx79H0W7cyqCxSng7:4WIz6AATVZdLOgT6R7j0nk

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c4f48a92a88dd72d6e92aaaebb8d674ca6bb3263999bda5d663791f89d28e9f.exe
    "C:\Users\Admin\AppData\Local\Temp\6c4f48a92a88dd72d6e92aaaebb8d674ca6bb3263999bda5d663791f89d28e9f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\6c4f48a92a88dd72d6e92aaaebb8d674ca6bb3263999bda5d663791f89d28e9f.exe
      C:\Users\Admin\AppData\Local\Temp\6c4f48a92a88dd72d6e92aaaebb8d674ca6bb3263999bda5d663791f89d28e9f.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of UnmapMainImage
      PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\6c4f48a92a88dd72d6e92aaaebb8d674ca6bb3263999bda5d663791f89d28e9f.exe

    Filesize

    256KB

    MD5

    df79f92229ea185f87c9bce552c1d23e

    SHA1

    7341903713cb19bf61e3dfe147eaf5b8b7ce75bb

    SHA256

    cec951acdbb32988e70c961168417b1245905610dc131c7218860c69a7379bd1

    SHA512

    0df751f9d49d70cf5f73db7a85c017745d42f5ac9452c963ab012f6fe18037de0e664b800ef3ffd9a6348701591c731279874b67f2cec2e98de81734e93fbde0

  • memory/1968-11-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/1968-17-0x0000000002BE0000-0x0000000002C21000-memory.dmp

    Filesize

    260KB

  • memory/1968-12-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3040-0-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3040-10-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/3040-6-0x0000000000210000-0x0000000000251000-memory.dmp

    Filesize

    260KB