Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 01:28

General

  • Target

    04c8e6deadc432af6c7f2f4c51e0c040N.exe

  • Size

    384KB

  • MD5

    04c8e6deadc432af6c7f2f4c51e0c040

  • SHA1

    b4d1228f8f13617be013ffc9d5f53f936a60ccd3

  • SHA256

    4e4cb96979c181e754c05dea487715342a4d7037b24c08e6cc9e92fffc42093d

  • SHA512

    3b9592b2db7e1bfc8dac13e01ec6b7b369f18a0c1e9cf451034af9ec8a5eca6b41be47cbf57cae829a43e781a0fb0c125b68e062381a6e77f6f34b079d2f0055

  • SSDEEP

    6144:MpujUeJJJrqu548zK6+sZGXp7Ve52SWhV40saiigCD4H2cS:McjUs9548zbTyp7g52SWhVQ5zCD4TS

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04c8e6deadc432af6c7f2f4c51e0c040N.exe
    "C:\Users\Admin\AppData\Local\Temp\04c8e6deadc432af6c7f2f4c51e0c040N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Users\Admin\AppData\Local\Temp\04c8e6deadc432af6c7f2f4c51e0c040N.exe
      C:\Users\Admin\AppData\Local\Temp\04c8e6deadc432af6c7f2f4c51e0c040N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\04c8e6deadc432af6c7f2f4c51e0c040N.exe

    Filesize

    384KB

    MD5

    931b4b91876f4bb435a7f84b4aaa5e46

    SHA1

    4f2f0c0c68336544e6e808c65be24afbff352cc6

    SHA256

    eda72cd8cf53e2031cf1b5e1eed1bfedbcdcc9b91694b80be0166fc3dc58d658

    SHA512

    2d7d8e8aaf9b3ca4fbcf2df16767194a307a1381ce82efc1e062da3c6ef106eaaba600900f5eef0bc8ee13fc20a70f7db98d6fe24a9ad492441936ae28f080a7

  • memory/2320-16-0x0000000000330000-0x0000000000376000-memory.dmp

    Filesize

    280KB

  • memory/2320-15-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2320-10-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2320-17-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2624-0-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2624-8-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB