Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/09/2024, 12:09

General

  • Target

    f3800a7223fa24b1df3efff490172e0b73afc2359303e2476247e070e4eb0911.exe

  • Size

    1.3MB

  • MD5

    e1bfe10f37183ae1803496a4e5d3b8e1

  • SHA1

    230b7232263789b3e43604770d923e2a66d3eb50

  • SHA256

    f3800a7223fa24b1df3efff490172e0b73afc2359303e2476247e070e4eb0911

  • SHA512

    cd2f27e76adfa7453fc048ae6bec4be426dce770f50fef1863c017fd24de774b4b4b3744bc645e3bcbf41fdf383d9ba1649fb54a0d25f9ff9b9b9acc687632b9

  • SSDEEP

    24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8ar7O55/JxphR4J4p91z:5TvC/MTQYxsWR7aPY5qJ4j

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3800a7223fa24b1df3efff490172e0b73afc2359303e2476247e070e4eb0911.exe
    "C:\Users\Admin\AppData\Local\Temp\f3800a7223fa24b1df3efff490172e0b73afc2359303e2476247e070e4eb0911.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\f3800a7223fa24b1df3efff490172e0b73afc2359303e2476247e070e4eb0911.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\myriopodous

    Filesize

    266KB

    MD5

    2476542408ac90f148e99ed8f691dec3

    SHA1

    a1a4324b846d65eb4b96b64c0950f40b47ca6db4

    SHA256

    ca234e98b06332b96ef115de4d5d5a419347248aa8b45c233e1ecee73f3ee7b5

    SHA512

    08b1a6833e6850edf0ab849f557adfb220244d0b04431e41eef3f1a25a585f9ed1dc4b7cb5bcabe98aa44745074268926d742021977b7d0414f2973c7264629e

  • memory/2684-13-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2684-14-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2684-15-0x0000000000820000-0x0000000000B23000-memory.dmp

    Filesize

    3.0MB

  • memory/2684-16-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/3020-12-0x00000000000F0000-0x00000000000F4000-memory.dmp

    Filesize

    16KB