Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2024, 03:58

General

  • Target

    e7cae85cbc2cad1f80d2335db61d167bd478c4e69ba2343c725d516edcb579fb.exe

  • Size

    87KB

  • MD5

    5c07cc4269969eb46cc292a9cccaa5e7

  • SHA1

    6f162fe9e7641a9678c031a94645abe3b78981d2

  • SHA256

    e7cae85cbc2cad1f80d2335db61d167bd478c4e69ba2343c725d516edcb579fb

  • SHA512

    cbbaf1e1d586f262967ccfafbc14458300a9f43e30fce94cfe94236c81e1c3cea2655d90c989816da9a95f118e6c4b0d9dd327e4afb3d39c791a3a3cda2f71c8

  • SSDEEP

    1536:GdWvtNFN+F+EchVsM/Vycyq1h6MtVYTjipvF2wI/KR11JdNqNY4X9/:IW1NWcyq1hnbYvQd26xU//

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7cae85cbc2cad1f80d2335db61d167bd478c4e69ba2343c725d516edcb579fb.exe
    "C:\Users\Admin\AppData\Local\Temp\e7cae85cbc2cad1f80d2335db61d167bd478c4e69ba2343c725d516edcb579fb.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\rianesad.exe
      C:\Users\Admin\AppData\Local\Temp\rianesad.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\rianesad.exe

    Filesize

    87KB

    MD5

    fdb0b46e0b4a866265b6116a1055ae41

    SHA1

    5d45d9084ecfaf44867424913342d57b520d3a13

    SHA256

    1400bebe316fcde384fddf7cc6c77f4fca8d41e29337addc13366cb826828963

    SHA512

    f5dfba9b7b1b2081f5f1fb1b074a784b641b67ee9dd034e26b65d39b00a58ae2290832a3345894a03e46ab94d2ab870f239fb5a7fa3544d484b1741885c4336c

  • memory/3044-1-0x0000000000403000-0x0000000000405000-memory.dmp

    Filesize

    8KB

  • memory/3056-7-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB