Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 10:01

General

  • Target

    33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe

  • Size

    94KB

  • MD5

    6ce2458407f8d01cf4de84d6fd295400

  • SHA1

    bd0a3b2dbb4719483c53372c46b58d1465bbd2f9

  • SHA256

    33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1

  • SHA512

    e77bcb50da2a01eec0e59ae32fbc622e3ab5b154bff800e457c24becbdf8f7ce80cddecc3cf46d7ac1ad4b2314f48bc46f7d37e311ad5f197bba70a0af0ffec4

  • SSDEEP

    1536:VNoceSeJ0xgP5BgC6Vdv90Dw4WXJrLDc0Rz/gyzRZICrWaGZh7B:vRe465BgCuVG81U0Rz4CJrWNZ7

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe
    "C:\Users\Admin\AppData\Local\Temp\33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\ProgramData\Graphics\guifx.exe
      "C:\ProgramData\Graphics\guifx.exe" /run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2988
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe" >> NUL
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\Graphics\guifx.exe

    Filesize

    94KB

    MD5

    038ee33ea1ea352edc0d189a0f14b1f6

    SHA1

    825e694691788907deb94b19a86564273f2285a1

    SHA256

    27404b7a35fb93245da381855229fbeafa7dbb5354c14de40255edf02fe50dea

    SHA512

    11a122c42c377d0777ee3890a598c4e862868710134da54134272617fb3444077c307def35dfd779e748f011377de0157dc007dadf562fac995c94a7b8f3df52