Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 18:37

General

  • Target

    0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe

  • Size

    3.6MB

  • MD5

    a0a8197b1721b0438150f5ed14a8948b

  • SHA1

    cc238d54e5fb0d341dbebef5d9550c66399185cc

  • SHA256

    0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51

  • SHA512

    58567e3725327cd90d47d17f06cea507feb27d54b45398f36e2c53ab0648d284f575d213daca37d61ef67cffbd64f8ccf78481c3289cb8428db2a697f4fbc9e4

  • SSDEEP

    98304:1iTy7HOC4ejiRsCe9q3HbCPDCsqua0VUpA3U:1BbO9ejMaq3uPDqJpA3U

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe
    "C:\Users\Admin\AppData\Local\Temp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Users\Admin\AppData\Local\Temp\is-277PR.tmp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-277PR.tmp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp" /SL5="$4010A,2907832,781824,C:\Users\Admin\AppData\Local\Temp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-277PR.tmp\0d7a6be7a56571c4f598ece87fb2d1b0dd1a9d3bfa76367edf9c60af3bf99b51.tmp

    Filesize

    3.0MB

    MD5

    e5d5fe01f4c160c87767b17b51d4b0c7

    SHA1

    c4352a64d4d751d2d78ce7ab8e44372cecfb2fc1

    SHA256

    08e3f17c3fbec1485463f9953d47c47142a7f3aae8b5196d8b8aaf4c92a54ab8

    SHA512

    ef5adc9ada82a6753194d407ccafd15e2a96458c0ab180f198badfcdafdd677a126b4c0b0b2963848ed66fccddee054f4e14e76ea5e503a617af7c6a06c72bac

  • memory/1084-8-0x0000000000400000-0x000000000070A000-memory.dmp

    Filesize

    3.0MB

  • memory/1084-12-0x0000000000400000-0x000000000070A000-memory.dmp

    Filesize

    3.0MB

  • memory/3004-0-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB

  • memory/3004-2-0x0000000000401000-0x00000000004A8000-memory.dmp

    Filesize

    668KB

  • memory/3004-10-0x0000000000400000-0x00000000004CC000-memory.dmp

    Filesize

    816KB