Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 03:55

General

  • Target

    dad90dcb687abddecde17d38953c6b9e51de0becc351fb9eab33e0bdd1d4dc6e.exe

  • Size

    74KB

  • MD5

    6e40ae444c148d0e8b7631bc069cfe0f

  • SHA1

    68234f57c5c41a71a34049a8fc9588a167f5f2f4

  • SHA256

    dad90dcb687abddecde17d38953c6b9e51de0becc351fb9eab33e0bdd1d4dc6e

  • SHA512

    711c847f07f743722ad760e672b05b53eef476f311ec6cdd3a0ab7b9766c6b7b3a6c80b39757ea391b5adbf31c025246ee8bb8750347f65e80320c60803491b7

  • SSDEEP

    1536:86RAo0ej2d6rnJwwvlNlIUBvsI7hrhEh9cpDN/qhAvP3OChhW4dI0h4HCIzhUvTu:xAo1lOwvlNlXBvsI7hrhEh9cpDN/qhAE

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dad90dcb687abddecde17d38953c6b9e51de0becc351fb9eab33e0bdd1d4dc6e.exe
    "C:\Users\Admin\AppData\Local\Temp\dad90dcb687abddecde17d38953c6b9e51de0becc351fb9eab33e0bdd1d4dc6e.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    74KB

    MD5

    dfededa04c0970204d2034c26b7d8ff0

    SHA1

    2a2bb6b71c974ba46be21fe8ff75d3bc680c11e0

    SHA256

    79e98d9df3855a3767cd1755792ea028395bbae3d4bf04aa0a2b1adbd80ade9e

    SHA512

    3f75321ef7b1ed9ab9318a77b2b90bb22244137a8f9b838d8656369b4e81654120f0db44a14f4b720b7b22248d720f52ef1e3594d5b55ce97fe28822e4c6348f

  • memory/1844-8-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/1844-10-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2392-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2392-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB