Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 12:22

General

  • Target

    b931920c17042d36d1fcaac5ca6cac20N.exe

  • Size

    9.8MB

  • MD5

    b931920c17042d36d1fcaac5ca6cac20

  • SHA1

    bb7a8d7cfcd28aafc210fa988f2b3356dbcd0feb

  • SHA256

    e7d65d47715eb27f4385a5fe74335623081feb128d330ed5c9fb2c5f9da08394

  • SHA512

    c2bd1d959d20be185fc2ecafa04e1a1b3fc0aa711e57572e5d48cd9f4052afb5f522d8e11344a2e292fb0b2c8324eec8a5a5c652983fac1b799bac8769494bd9

  • SSDEEP

    98304:rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGyooooooooooooooooooq:Q

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe
    "C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe"
    1⤵
    • Drops file in System32 directory
    PID:1820
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\svrwsc.exe

    Filesize

    10.3MB

    MD5

    9f8d5ff3e7d0db6ef8e2a74632469f11

    SHA1

    b985e54f21a9784641f975677624a897adb3eb93

    SHA256

    e5faeeee6584147335688a48e957507b5a39bca35c3b98db1aae20ad03b42d5d

    SHA512

    d44b536f12faef2008d4f8a13b4aebe9cfc41947e8bcd9ebf1d2d0bafb6283b3f8a63d5caf51bae6f48d29f0cc7f18652a133b1e2065974122dd10027ec2a0b4

  • memory/1820-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1820-3-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1820-2-0x00000000003B0000-0x00000000003B5000-memory.dmp

    Filesize

    20KB

  • memory/2000-6-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB