Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    110s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/10/2024, 02:03

General

  • Target

    c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92bN.exe

  • Size

    1.2MB

  • MD5

    3f3a4a55b932ff8967ce6b044d80da40

  • SHA1

    03254a9ff7347d73605c96c542a22f4b92f51554

  • SHA256

    c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92b

  • SHA512

    74c19cb79d76faa9223db66b8fd5d5b3773009066da312db8e5579e68cb21770b23db3f0f43b6ecab80fcec8f1a6e2711824acf21460d0ea03b09b2c6e9a3ddb

  • SSDEEP

    24576:4y/4UiZTW//ao6BRm4hLKmVVTcBKo/KSg+yJJod3reFA6ymcLqS:4y/a1BRm4dKwVTUnsbod3apymcLv

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92bN.exe
    "C:\Users\Admin\AppData\Local\Temp\c0bcf1aa047d8b4a7cef9349faeb0fcba14550eb20819b2931ad6338e429f92bN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\94ED5B7B.nbp

    Filesize

    294KB

    MD5

    e5575e8d61ca62bdb7491b88df590ce3

    SHA1

    c0580f4d63298f508cc7a9b14d0e7477f5a4c27b

    SHA256

    df135026069742aba1b255b9bde400749359e1a821aee3799daf15e5c58872e5

    SHA512

    c423404cae5d90e5fe8d98cdf55a92bd815940128b9a7c8e647a36db02623f621fe7422bbe2e75009f33bf3b6229d1947c70776b042195cf747b5d14460a4a0c

  • \Users\Admin\AppData\Local\Temp\94ED5B7C.nbp

    Filesize

    422KB

    MD5

    2fd0836d049bdffdc11d76b36732f3fb

    SHA1

    e751066f381525a4e2b892450fc00d90c60bb271

    SHA256

    26977cf094ec15191beef7268a41281a1fa0f22221c485ea8ccad9f7142d4445

    SHA512

    802b1cb9d2a129fa36968dde62539d76a265470e8a1db68d08877e83ba5c1101a7d24ec09198316cd15c37d1e54452fa643fcb4689a37c1b1183940ab642a46b

  • memory/2700-16-0x00000000039B0000-0x0000000003A47000-memory.dmp

    Filesize

    604KB

  • memory/2700-11-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2700-10-0x0000000003B70000-0x0000000003C5E000-memory.dmp

    Filesize

    952KB

  • memory/2700-9-0x00000000039B0000-0x0000000003A47000-memory.dmp

    Filesize

    604KB

  • memory/2700-8-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-12-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2700-17-0x0000000003B70000-0x0000000003C5E000-memory.dmp

    Filesize

    952KB

  • memory/2700-15-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-18-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-21-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-24-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-27-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-30-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-33-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-36-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB

  • memory/2700-39-0x0000000000400000-0x00000000005C6000-memory.dmp

    Filesize

    1.8MB