Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

8332223587...d5.exe

windows7-x64

7

8332223587...d5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 20:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8332223587ad3dcef7c7cf80ffa1e44626a162759363cf3f2ecb67a8e609a6d5.exe

  • Size

    1.1MB

  • MD5

    5fb49a79a25f5242c68dc4a62d5fe347

  • SHA1

    71f00c54d8ef94961384770cc6e392ff4b54b76d

  • SHA256

    8332223587ad3dcef7c7cf80ffa1e44626a162759363cf3f2ecb67a8e609a6d5

  • SHA512

    d16b007f9ff3120eb363bac8767ef17830252250fce4563a41ae0c50b526ffa4c4b9f8a8ac9dafdf8f7117144a9a8252ea266c36cf418d22455ec2cabf0708d1

  • SSDEEP

    24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q+:acallSllG4ZM7QzM1

Score
7/10
discovery

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8332223587ad3dcef7c7cf80ffa1e44626a162759363cf3f2ecb67a8e609a6d5.exe
    "C:\Users\Admin\AppData\Local\Temp\8332223587ad3dcef7c7cf80ffa1e44626a162759363cf3f2ecb67a8e609a6d5.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2616
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
    Filesize

    753B

    MD5

    fab614a8ae7bf6c2df09a8146a393625

    SHA1

    2e707201e456922b688c33dc2febb4b5e84ec326

    SHA256

    2795c507c2d18337d5ea3b2ef181a342093aaefc8cfa328660a4adcc72761436

    SHA512

    a1736f7b2b1684b5a75b2b4b3738f4d8a103c2f5ab18cdc09bde1eed6991768c9b0894bc0be7c020369b24f956e325df39943d348cb12ed5e8e0b45cbc9d802c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    Filesize

    1.1MB

    MD5

    ed8c3e78b3297e90ddb1cbc742a58394

    SHA1

    84c012952de0589083f78892794bbb3089588df9

    SHA256

    09fffde6f24be7ee8f549011fcc020ce4783a5413f7d54557af9bc7b41877339

    SHA512

    fefe315108a4560fc1167f18405dd144398821aa86cfd255d3dd35999d06f494d1376056fddd50d321609eda72b907307fac712216b2ab0707e83f60879d8775

    Download Submit

  • memory/2180-0-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2180-11-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2232-20-0x0000000004850000-0x00000000049AF000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2616-22-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2616-23-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2684-21-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2684-24-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/3048-19-0x0000000005C00000-0x0000000005D5F000-memory.dmp

    Filesize

    1.4MB

    Download