Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 18:25

General

  • Target

    07c2273c5687532dba09c2a4cdd02e2b0ce566e5a5bf7cc0a313f13309fec34d.exe

  • Size

    50KB

  • MD5

    caf8b21f5db9f183b773ebc78aad845a

  • SHA1

    78f900c0b298d8268d3539d2ac3a6c78f429ebb4

  • SHA256

    07c2273c5687532dba09c2a4cdd02e2b0ce566e5a5bf7cc0a313f13309fec34d

  • SHA512

    d699cec554fdc05630b1fc8a5e4949d336705e3a39bc0e47a7b1d7da8e06749f4d46b9ebde7245385504f2268f1d98b0f029d7e6a8cba6d251dff9e9c733eb3d

  • SSDEEP

    768:mzQYScGrIubHuYtvdxwYHw5FAe2Qkncwx9vMdJTeTXpnHTkGrbHdrzxDvDInmI:gQTIubHy5wQkJAejpzkGdxDLImI

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07c2273c5687532dba09c2a4cdd02e2b0ce566e5a5bf7cc0a313f13309fec34d.exe
    "C:\Users\Admin\AppData\Local\Temp\07c2273c5687532dba09c2a4cdd02e2b0ce566e5a5bf7cc0a313f13309fec34d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Program Files (x86)\78e27f86\jusched.exe
      "C:\Program Files (x86)\78e27f86\jusched.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\78e27f86\78e27f86

    Filesize

    13B

    MD5

    f253efe302d32ab264a76e0ce65be769

    SHA1

    768685ca582abd0af2fbb57ca37752aa98c9372b

    SHA256

    49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

    SHA512

    1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

  • \Program Files (x86)\78e27f86\jusched.exe

    Filesize

    50KB

    MD5

    d51554d044a3461b7795d871d162ac04

    SHA1

    968ce3d657720bc0fb86421218bd00675e796bb8

    SHA256

    48dc70af61f598f1e7d54ae5b8eb974accd80b7a5a8170db52b2fb0f6558f424

    SHA512

    a997bfc9862d6cd28cf7090ea019113f10e1697cb840119f97d2956a0cc5411ba1809997664d395b3a72b6e52e9df834ebdbef86ffb072525f534c95eaceee34