Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 19:21

General

  • Target

    1b3b096cbad798c6b2248ea4c97ef9b4373bea975764b29bb5b017cb3889256b.exe

  • Size

    51KB

  • MD5

    0b73722747b3f85d98a7226bfc0d0ba8

  • SHA1

    925e6fc2f89d8433a2471148cd8ec74860148652

  • SHA256

    1b3b096cbad798c6b2248ea4c97ef9b4373bea975764b29bb5b017cb3889256b

  • SHA512

    2ba76917bf0b510c9cd9d809bf743d04bc2a131c3ba52cf94c70c89916d75420df4619caaa43bcbefdca888c2ddf8d064d91d753887dc0c42f458bfb97bc66ff

  • SSDEEP

    768:RzG9lCapIyMsDlfjQelqYreP23SUx94NMyKZSH:g9lDpI4zFSUFXZSH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b3b096cbad798c6b2248ea4c97ef9b4373bea975764b29bb5b017cb3889256b.exe
    "C:\Users\Admin\AppData\Local\Temp\1b3b096cbad798c6b2248ea4c97ef9b4373bea975764b29bb5b017cb3889256b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\hots.exe
      "C:\Users\Admin\AppData\Local\Temp\hots.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hots.exe

    Filesize

    51KB

    MD5

    4a3c7fb9d6abc2d4c854488bffe55443

    SHA1

    2eb398c161d9cec1bab35a1eb145a2b57818bcf2

    SHA256

    482d16fc85d27bc3e2f3ae015158261880768f483a690d17bcf6cbd5e4ff6f8c

    SHA512

    23fa38ad97d4c29e064e5a30fe0121be4aaf2870d4ed7dbe1ac943099a3ca64c69a278e89758e5a3a246ca9dc102dd9916e4472fac15f6eb0c751b998bce47ab

  • memory/2128-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2128-2-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/2128-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2128-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2128-13-0x0000000000570000-0x000000000057C000-memory.dmp

    Filesize

    48KB

  • memory/3052-19-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3052-27-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/3052-28-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB