Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 02:41

General

  • Target

    c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe

  • Size

    56KB

  • MD5

    066b327b839fff241826b3b66248ca99

  • SHA1

    ba8e94cda3226a12a1213ce049c28bf320933c24

  • SHA256

    c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4

  • SHA512

    9c04422872588426d2619b22692d89bb3ba2d44fe8725e817c92e89992ef85ae80dd7a615700cdc21fbec757e1bfad1471c2139cfeb5d808b805f4f059c4a27c

  • SSDEEP

    768:jxDDnyAiIbhn+oRTaFSxjquEDFAnA1tLRNk2djaYoCMHosOxECOsPNu:jxDDnd1Raqq2uBNdSCMxCV1u

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe
    "C:\Users\Admin\AppData\Local\Temp\c8c9aca6b4b12ce0df5b2c43171828b354a20310973f0112dc19567fb787c6d4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
      "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
      2⤵
      • Executes dropped EXE
      PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hcbnaf.exe

    Filesize

    56KB

    MD5

    03ddd2453f95345ad73a36bb7b232e00

    SHA1

    6a54b8f7de07f8bb072ceee621e7259096295de7

    SHA256

    746a2766ba24c8f6e451cc88721c1741cc7fb7cdb5a912ed9610da03e7bb2986

    SHA512

    3acda57350f292394c0883061aff7d8c960cf54620bd78f359d30a96555895651b027882b12692e45939f0aa0215e70e20a89f749f7aebb510ecd163046fe15c

  • memory/1924-1-0x0000000000260000-0x0000000000264000-memory.dmp

    Filesize

    16KB

  • memory/2320-8-0x00000000000B0000-0x00000000000B4000-memory.dmp

    Filesize

    16KB