Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 00:35

General

  • Target

    2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe

  • Size

    200KB

  • MD5

    a68eb08da5641393687ca0705e423db0

  • SHA1

    48300a4854e2f573b0338281eddc19b777e401f1

  • SHA256

    2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28

  • SHA512

    a33454db305c3a349481f9527aa225ea3358015b5176b32908e968800258e553683304cdf7d6bd7604fa5ffc3e612fc4b600ccd3bd47002d3b09607f6a8c98e8

  • SSDEEP

    6144:XdjUIplSG5LrSvcwc7yeLGzSCsddc8G1B7u:hFSv7eLsBAdTG1BC

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe
    "C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe
      C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe

    Filesize

    200KB

    MD5

    3d8d7f51a46539ce782e912edf12c0cd

    SHA1

    cf83b8d34cec7cc979d924713b6a7619591640c7

    SHA256

    27fc1b6901a468df2f04d17855d54c74419c307bdd4d51413c1f704709685e6a

    SHA512

    1234b9df19ee95412c39500c095b4d07a1b8e93a096a8b23032cc5f26202f1e1bbab214cfdc88d3e7eee948c250648063c6f691eea7bc6d8c4adcd257c04c23c

  • memory/1732-0-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1732-9-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2616-10-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2616-11-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2616-16-0x00000000001E0000-0x000000000021F000-memory.dmp

    Filesize

    252KB