Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    97s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 15:06

General

  • Target

    22afa4b6d9eb6b052babea1242fd3420N.exe

  • Size

    83KB

  • MD5

    22afa4b6d9eb6b052babea1242fd3420

  • SHA1

    f636a3075db4fa75ce5e185bfe00fd34552a8eba

  • SHA256

    000d9f1e3e6f13f1a7ef2397b44ba24a8d0bd6543b5d7f9ce846f837006e6d57

  • SHA512

    efa3b0c2639b8615a9a1aa69f444c4a9c83a2244cab59e5b4d1198f2b4e8d1b79cb780288ba0cd157ce055ba53977914541166b93e48b68c767cfa2df55202fe

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+iK:LJ0TAz6Mte4A+aaZx8EnCGVui

Score
7/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\22afa4b6d9eb6b052babea1242fd3420N.exe
    "C:\Users\Admin\AppData\Local\Temp\22afa4b6d9eb6b052babea1242fd3420N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-8KaeWsKztKwENvvs.exe

    Filesize

    83KB

    MD5

    997cf51e81844f6645768e20a5333aa8

    SHA1

    5de47c37c3696c7f880030d6442f03507313c55a

    SHA256

    c4557c609fe6294b31ab375ab5aeb35d9f287fff9ba4fa0057d4efb7751889e7

    SHA512

    c3c041f37a2ffaae10ba144a142a395f608412b229ec08d5ebccd5c7e10a4f8b46e9dd47f944254be1d947a6633470342f2f1d4956264cd9952e96bf4d4c69dc

  • memory/3008-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3008-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3008-5-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3008-14-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3008-21-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB