Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 00:26

General

  • Target

    7b6df049686de51044e89e17b90f1b570e93c920f1d99f5fcf9874bf28a4984d.exe

  • Size

    38KB

  • MD5

    df3b881bafc1ee3f0be101c07d0a5581

  • SHA1

    c7c899fa253b8e1b8d751234c6aabc04bf22dec7

  • SHA256

    7b6df049686de51044e89e17b90f1b570e93c920f1d99f5fcf9874bf28a4984d

  • SHA512

    628238d93c059370922501f8313fddcb05bc99b8bbeb685ae67dc0dac816a41c116f698fa2ccde683ce1dfed0237e58eef35fce317304f8b310edc2da69f26f0

  • SSDEEP

    768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh4:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYY

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b6df049686de51044e89e17b90f1b570e93c920f1d99f5fcf9874bf28a4984d.exe
    "C:\Users\Admin\AppData\Local\Temp\7b6df049686de51044e89e17b90f1b570e93c920f1d99f5fcf9874bf28a4984d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    38KB

    MD5

    cd2302908b3052e5115badaa0425c965

    SHA1

    108f2b04d552e957d3d622bfa23ffb576475e29f

    SHA256

    944ffce6ae1c3ba71e7ab383d85b208e806fc1949f95a91c8131026cf2e5dc9a

    SHA512

    f041e3899fb8abd389c9e8cb383905a0a4e833213d26501d64bb69403af20d92ea934b6e4c1d9b92a2a0a310bbededdb2f7950014d5b62f8cce871369daea134

  • memory/2320-8-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2604-0-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2604-3-0x0000000000220000-0x0000000000223000-memory.dmp

    Filesize

    12KB