Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27/06/2024, 21:30

General

  • Target

    4011de9e38bf98bc6690b1d7a1c3e83298c2fbe44e16e041a893d2ecebdd6e17.exe

  • Size

    9.9MB

  • MD5

    25a2620ac9f1dc93e674fa5e67ff0580

  • SHA1

    33d11accab7b7d3fbe10a6a4f9926cb39f1a1884

  • SHA256

    4011de9e38bf98bc6690b1d7a1c3e83298c2fbe44e16e041a893d2ecebdd6e17

  • SHA512

    fb99079019229ce1336934e93541155ae81f001d9e8a8b7f3af1f4b556b925564855928118cd033e41c8c2d12f8bf0c0b623ce601e67693ce1e9cceb6d51148b

  • SSDEEP

    196608:RAydYJbaogx4gQCfGJAieLP4bbGNg3ooy4TyMN:buHg+glGJApz4bqQooyQyMN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4011de9e38bf98bc6690b1d7a1c3e83298c2fbe44e16e041a893d2ecebdd6e17.exe
    "C:\Users\Admin\AppData\Local\Temp\4011de9e38bf98bc6690b1d7a1c3e83298c2fbe44e16e041a893d2ecebdd6e17.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230819.lib

    Filesize

    1.6MB

    MD5

    a1df3b7884c175c967505a589ba51da2

    SHA1

    7aaf570e41a00149134973d00f4efc09c4b650c2

    SHA256

    c16014329cf6f242a525f6782dd10f6a4d0ff6f97239710fdc45522f5c6da525

    SHA512

    12b8bd05fd9bec79d643edb503634b8b5238c67c77ddd8d2c3220406c08b1e6197e8aff02c709e353bc4ce9353a6709837b81ca443660250d94e73c00d66f451

  • \Users\Admin\AppData\Local\Temp\f761803.tmp

    Filesize

    333KB

    MD5

    56a2bcecbd3cddd6f4a35361bf4920d6

    SHA1

    992e63be423f0e61093ba183f49fc0cbec790488

    SHA256

    5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab

    SHA512

    473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

  • memory/2008-9-0x0000000073AB2000-0x0000000073AC6000-memory.dmp

    Filesize

    80KB

  • memory/2008-12-0x0000000061080000-0x0000000061119000-memory.dmp

    Filesize

    612KB

  • memory/2008-13-0x0000000073AB2000-0x0000000073AC6000-memory.dmp

    Filesize

    80KB