Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

41f305966b...d5.exe

windows7-x64

7

41f305966b...d5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    13s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    41f305966b37c2b271e7ab24916974e1d718a1030a040ddf1d244ad20d87bed5.exe

  • Size

    1.1MB

  • MD5

    5594ca4026e51f7dba91b57d9f145451

  • SHA1

    4c4cd7fd06f710cd38cc8f76ff2057a35576d5da

  • SHA256

    41f305966b37c2b271e7ab24916974e1d718a1030a040ddf1d244ad20d87bed5

  • SHA512

    68c27464b7a5d28611d1717f8410922cb9e88132d66d9fce8963c5d525d0b864f0c9c99d39244f1962454173b075b003002693de519b8947d158d9789497349a

  • SSDEEP

    24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QX:acallSllG4ZM7QzMw

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41f305966b37c2b271e7ab24916974e1d718a1030a040ddf1d244ad20d87bed5.exe
    "C:\Users\Admin\AppData\Local\Temp\41f305966b37c2b271e7ab24916974e1d718a1030a040ddf1d244ad20d87bed5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2696
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    d64bd105f8362cca219c4561a240e981

    SHA1

    3eab15acd9be2b9159cbe0676bfd4b1b779b3450

    SHA256

    0fa997bc5e989ed2a00919093d582fb8e39c2328596ff2c9c0eb710157de28e0

    SHA512

    cc3d997ec80c5c31c2853f541beb6fcc52546cc23bc4ef591eb54ee121e9a704f84bdb3436d4ef1ce323990e72fd80d79bdb36cb17e16152c9be2f93928766c1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    04f43c0938f04849f9b1bf3810aba648

    SHA1

    a49ea30bf1d56980389d55109523c2b8958b1821

    SHA256

    312bc4ab645d966eaf6b93a63cd45edaaf26ede75f02d4ca2869844fa9c99636

    SHA512

    2e63b348b8ac154e6fad2d88cf499a69f4185aa6c48b23100e00c9cfc3d4ba518d851c0f9be57d465f71ae48bb1a8e6195bdd7af77e116c1e6fec1392a781cab

    Download Submit

  • memory/1996-0-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/1996-12-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2196-15-0x00000000050A0000-0x00000000051FF000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2196-18-0x00000000050A0000-0x00000000051FF000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2204-22-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2204-23-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2696-19-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2696-24-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download