Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3e99df557a...dc.exe

windows7-x64

7

3e99df557a...dc.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 20:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e99df557a0920bb7488a4a41af20aa1a28abc70ea812dc6f1ee73d7ba9226dc.exe

  • Size

    4.1MB

  • MD5

    f23b6c38ca549e8a617e0d994a2e223f

  • SHA1

    7e8f9da9e6d7d4829ccd96a235152749e57bde20

  • SHA256

    3e99df557a0920bb7488a4a41af20aa1a28abc70ea812dc6f1ee73d7ba9226dc

  • SHA512

    696aabe3ec4da5d2eb4457633ae2da93c6b0e180366071626b50222722583fea735ef939778f098df978d744c91f04e75a9bc9ab851cb5ed2f2c926e3b1ae062

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpR4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm25n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e99df557a0920bb7488a4a41af20aa1a28abc70ea812dc6f1ee73d7ba9226dc.exe
    "C:\Users\Admin\AppData\Local\Temp\3e99df557a0920bb7488a4a41af20aa1a28abc70ea812dc6f1ee73d7ba9226dc.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\UserDotP5\devdobec.exe
      C:\UserDotP5\devdobec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Galax2J\dobdevec.exe
    Filesize

    5KB

    MD5

    3c1447a32f4850436e6a2de47925bc14

    SHA1

    330b5e43ee4e330d7602e1d148b82ddb50b12a19

    SHA256

    293da501871baaf7bbb94f933d180eeda1ab4e177269dbf9009f7b0affb5cf94

    SHA512

    f9e04d4e15b7137a5a1aa19f435a3eac87106d592f2577822a23d928dcace63d581f7c5af90d73b77ffa94ef555dd29e8a1ec2de6d498148e5815c61b71b3b19

    Download Submit

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    205B

    MD5

    bbe394c57162ecb116b6192cb521526a

    SHA1

    1e20ef26fee82963c18c6458d608d5284e0ceb67

    SHA256

    6bcf0b1c488c8b353e96dcea4effaf40c87f28cc8ca588e2c1e3710895a45c10

    SHA512

    dcf93ada36ea75f30a15d7cd2ff3f4836f8bb226c61910ea487d6e7548aec6fed84b3cd2e28884a9a56c81bcd0295b5faa5eae68ce2c3c2cda3a5fa9a1b992d3

    Download Submit

  • \UserDotP5\devdobec.exe
    Filesize

    4.1MB

    MD5

    60b6320095f61f3fd38ffffe321eb715

    SHA1

    c3840746141ee993f61792c2cea33f7576227ade

    SHA256

    f60068c4293a6fa7da1fff0ed0aa87e79b794d2244aea29811f891c739d24565

    SHA512

    2ef30aa669cb9d271e57030b3c74791ba97f804c9d858ea36d7ec2c61619956e5e875c337b61a012737da11dd6530194f83751e89c8f9beca9efdccf995b0fbb

    Download Submit