Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 03:38

General

  • Target

    acbb4135e99fda2743bf7666911c63850ed3474f68488f09fc3cd0277721fa3f.exe

  • Size

    432KB

  • MD5

    ad7647a490859595c8ca0f33abd1e3fb

  • SHA1

    f20d78cc0efa4a9cbf8cad5a14ddbdda214be204

  • SHA256

    acbb4135e99fda2743bf7666911c63850ed3474f68488f09fc3cd0277721fa3f

  • SHA512

    d1d937843ef4f4702768af7149c89f45715ec21e3f5924164011b14625e28c8a52afe14cd5b2a91ec8159d2d0ddb59d3c72265d2f3b87e32b82836097bb0e813

  • SSDEEP

    12288:4jauDReWhAbuBPjKzQowI8C3bFJhOPwKJZy3bFJkvd15crjbp/kcn5+dnUZc0l0t:4DDVA0KuthG1TN1Et

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\acbb4135e99fda2743bf7666911c63850ed3474f68488f09fc3cd0277721fa3f.exe
    "C:\Users\Admin\AppData\Local\Temp\acbb4135e99fda2743bf7666911c63850ed3474f68488f09fc3cd0277721fa3f.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\ProgramData\rwfqo.exe
      "C:\ProgramData\rwfqo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    432KB

    MD5

    2f72fae3bf00ae0cd92105669f902c28

    SHA1

    3777ed88dc61580b31fed0c52befeeffc1a085ee

    SHA256

    131790784fccd65dec9e64b7cbb590dccbb895bab3e285f7974d24f8670c38d9

    SHA512

    299f5430398e8c514b9157ca1788f4694a4838916240dd0cbf90d983bfcb8746b286a20c8d0cea0a3c85d42dcb7f36f7346d62ff1594cd3316066678912471fb

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    136KB

    MD5

    cb4c442a26bb46671c638c794bf535af

    SHA1

    8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

    SHA256

    f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

    SHA512

    074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

  • \ProgramData\rwfqo.exe

    Filesize

    295KB

    MD5

    0ef6bc7c9322a5fb140b2b6e61f329a8

    SHA1

    1c4bb125b8cf4f25714268d9e728c1a8b9271c25

    SHA256

    b927d53902f53b13f0263b37ff953afddfedb60c4efe9e7bcbc55b94b776d050

    SHA512

    888e46a919506e8d62eb0fc0dfdcc8eff0af020a818886ec62a34610513520d6c0f0fc4bf6fcc23b6445f5cb30373ab94c020edae4e464d466699272a007e86f

  • memory/2548-0-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2548-1-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2548-14-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2692-137-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB