Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 10:07

General

  • Target

    be3c24755243df82d3f1cc1ed1bd3d70N.exe

  • Size

    408KB

  • MD5

    be3c24755243df82d3f1cc1ed1bd3d70

  • SHA1

    a8c799ab3e7979672b199900b14ac7a960bf14b3

  • SHA256

    2090d63e62edd2776154e999ca80010e5258c6a2337d4142d563ad2e52fa32db

  • SHA512

    3eff60720d18e248d53e63258275e3f297ffc33509f3998fc72c2d8e39a5756769031e8876e6e0a150abadb71444b3d9cb55980bb9b08f22e7c9ce844ae3ef46

  • SSDEEP

    6144:Dck18MipfIUaQYu8tbS6JBcj0U5hjX/Tvf8MjKFW8jb/HVbdsifRe9+fHrGJH:DX8Djadu8J4YSjX/THKxr1bBGsHrGJH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be3c24755243df82d3f1cc1ed1bd3d70N.exe
    "C:\Users\Admin\AppData\Local\Temp\be3c24755243df82d3f1cc1ed1bd3d70N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\SysWOW64\svchost.exe
      C:\ProgramData\df0j488b8j.exe
      2⤵
      • Adds Run key to start application
      • Checks for any installed AV software in registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2180
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\qty4A70.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\be3c24755243df82d3f1cc1ed1bd3d70N.exe""
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\qty4A70.tmp.bat

    Filesize

    30B

    MD5

    ea14f242be23d63750b9aeeaa59e7cd5

    SHA1

    378813803fe52af29cfd8b1f2439ddc2d5746e41

    SHA256

    d77e9f26554283c40a388fabc593918d600f03d680feb0bbdbc4f2f7a3e29a00

    SHA512

    d589f6b0bf63f45fc5ac2de14dcd719c1ca1bf4a2f548628478d0fce7d70de173311da27534fab05be77d0653dc430085fc9abdbd59542d6d63431d39f838ec0

  • memory/2180-12-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-322-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-329-0x0000000000310000-0x0000000000410000-memory.dmp

    Filesize

    1024KB

  • memory/2180-6-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2180-5-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2180-7-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-14-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-13-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-294-0x0000000000310000-0x0000000000410000-memory.dmp

    Filesize

    1024KB

  • memory/2180-295-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-292-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-327-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-323-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-10-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-311-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-11-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-9-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-8-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-318-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-314-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2180-315-0x0000000000260000-0x00000000002D6000-memory.dmp

    Filesize

    472KB

  • memory/2556-1-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/2556-310-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/2556-3-0x000000000045A000-0x000000000045E000-memory.dmp

    Filesize

    16KB

  • memory/2556-0-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/2556-4-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB