Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    79s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2024, 23:36

General

  • Target

    c92d98d875a16e21a2e3819b8ad1c9f0N.exe

  • Size

    94KB

  • MD5

    c92d98d875a16e21a2e3819b8ad1c9f0

  • SHA1

    2faaace607428c77293ecab6b55ee23df7ee16d3

  • SHA256

    ad7963d2d44ae34de42ad5ebd5f3446a2bfaa43b2cfbe7d74f639b8d9f3eacff

  • SHA512

    fd126e090dabc502d53f1e38d999033b1324492cb438b810288f61c2ab74cdca6e0f837133365795e3d7ad4eb270b593c719de48bc65885ae7995fad4905de9f

  • SSDEEP

    1536:ZY9QqDLnx1USBGvEJHKr88+FcG8fNRsBIlx/DPIP6PONWQIDYNuJ+Zdjsa:i6qPx1jBGcJM88+cIW37Pe6hhUNuUZRx

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c92d98d875a16e21a2e3819b8ad1c9f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\c92d98d875a16e21a2e3819b8ad1c9f0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\c92d98d875a16e21a2e3819b8ad1c9f0N.exe
      C:\Users\Admin\AppData\Local\Temp\c92d98d875a16e21a2e3819b8ad1c9f0N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\c92d98d875a16e21a2e3819b8ad1c9f0N.exe

    Filesize

    94KB

    MD5

    8d916ef9a71ad6b9fc1938de8d6c9afc

    SHA1

    9066f40e9274781356e162754e53fdd41021fe73

    SHA256

    4d4aac23272c3364e66e175b1be57fc995dc01dea1177872943d53fa07a1a65a

    SHA512

    98896dd84f57d128d807d269792293eaa3331856e901845e473f21d75a5be529107bc8b2939b35bdc9e275e53fd45c472ad7cad1662a8f44ef9181514ba56c08

  • memory/2552-17-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2552-19-0x0000000000140000-0x000000000016F000-memory.dmp

    Filesize

    188KB

  • memory/2552-30-0x00000000001A0000-0x00000000001BB000-memory.dmp

    Filesize

    108KB

  • memory/2552-25-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2552-31-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3032-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3032-1-0x0000000000140000-0x000000000016F000-memory.dmp

    Filesize

    188KB

  • memory/3032-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3032-15-0x0000000000190000-0x00000000001BF000-memory.dmp

    Filesize

    188KB

  • memory/3032-18-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB