Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 07:19

General

  • Target

    RuntimeBrokerVers.exe

  • Size

    13.1MB

  • MD5

    197a1e583ca110d62ff0d47fdb966f75

  • SHA1

    0a3e22480bbc64a62dcf2aff46b786c349eb5cf2

  • SHA256

    66ade039cb8cba332bc00e7cf3b0315ff8f78417b0f44150fb1b657677cd2958

  • SHA512

    adbc41fd702d842c61d007a4ade09358d628b64586c19d04769d0d47a3ca804f058865a7f8a435a2255a15da6d5219e9809f726e08b19b49fa71e54cb534180b

  • SSDEEP

    196608:e4z5aWpRNf+IJs/WP6eOEXdb8F9JRGoUbH6pm+TeDN99EQRDcegSDm5YTW68iS0Q:/hpR0IJ9P6eO2dboBUs8+YLgzqCUxwS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RuntimeBrokerVers.exe
    "C:\Users\Admin\AppData\Local\Temp\RuntimeBrokerVers.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\onefile_1924_133701671893614000\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\Temp\RuntimeBrokerVers.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_1924_133701671893614000\python311.dll

    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

  • \Users\Admin\AppData\Local\Temp\onefile_1924_133701671893614000\RuntimeBroker.exe

    Filesize

    23.3MB

    MD5

    8530bcffbcd37c8a067297f082183876

    SHA1

    efb9be0f7eea1d791a5b0722b9f87f2836267857

    SHA256

    7ff988010d505d3f6b3dd98acade0421db0df53c93cab9d9c27779e956b3c597

    SHA512

    7de5b7da93a8a24240b1cdbbbb302c3080d89f26a13ef44c3164d2308abf8168b887a36e77a4b03bd0e4cdd9c5415e524a08509e0e5aa3d3e0add5dfe0fd27d3