Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 18:55

General

  • Target

    3d866a10db689c3407cad373c59828a293ef385ec4ac6426d3e1640a2ece5149N.exe

  • Size

    296KB

  • MD5

    75b7ec1c2908e43dbae45584622c6470

  • SHA1

    9cd45cbbcf12a7c832256255211b764dd87a064b

  • SHA256

    3d866a10db689c3407cad373c59828a293ef385ec4ac6426d3e1640a2ece5149

  • SHA512

    8ee2bf2b066ca9703120daf73739e6de7e6d55bbaa1de8f815fcf219d53432bf12073102d2a86d9ab28fbe3b4376d0646f94184dc2d94a455c7e156c3c6fb512

  • SSDEEP

    3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d866a10db689c3407cad373c59828a293ef385ec4ac6426d3e1640a2ece5149N.exe
    "C:\Users\Admin\AppData\Local\Temp\3d866a10db689c3407cad373c59828a293ef385ec4ac6426d3e1640a2ece5149N.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Program Files\click-through\meter.exe
      "C:\Program Files\click-through\meter.exe" "33201"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\click-through\meter.exe

    Filesize

    296KB

    MD5

    ee8880d4d23dc51cf724dbb81b7656fd

    SHA1

    bc8b2b175e45a9ae40d200ced7c21f3d6d70ae2b

    SHA256

    7f44c71fc33700ab15f06697f46b7bbc8a8e37904e3a1f7b25d9b2a4335dede5

    SHA512

    945b33f782398f5e7d89106d2ed33cde327661aabcafb341713e28075b3aea7af64c050e81fa00a7aa9acfbc796c3e1785933c88b37c4100348257a38ce09d15