Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/11/2024, 19:57 UTC

General

  • Target

    c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08.exe

  • Size

    2.6MB

  • MD5

    8e921737fd53f5a40e982495f0c7c3c9

  • SHA1

    c46e2cae95d387f64964fa000b8daff2f646bdbb

  • SHA256

    c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08

  • SHA512

    e767b00c4ea757b4af8dd0339260f5748d2475d5b94c6c2a83d20077990379068e8bf7bbfb7b2cf1015ad4f56968456131447ab63225975d2bb5cdb2535f0fdc

  • SSDEEP

    49152:rTOYjy2jq6ZutrfM2IAIbu/GFcThB84muqmSj9TgM/rhiYO/CeQTWoNdjjEPOaDT:rBIknAIbuQ2mtnhiY8dT

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08.exe
    "C:\Users\Admin\AppData\Local\Temp\c413b5fc353f566a47c17c56b69b2cc7b33e048673b78678d33b3aa8804d1d08.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2820

Network

  • flag-us
    DNS
    araguatec.addns.org
    csc.exe
    Remote address:
    8.8.8.8:53
    Request
    araguatec.addns.org
    IN A
    Response
    araguatec.addns.org
    IN A
    181.141.40.225
  • flag-us
    DNS
    contath.org
    csc.exe
    Remote address:
    8.8.8.8:53
    Request
    contath.org
    IN A
    Response
    contath.org
    IN A
    69.49.234.173
  • 181.141.40.225:30201
    araguatec.addns.org
    csc.exe
    482 B
    352 B
    7
    6
  • 69.49.234.173:443
    contath.org
    tls
    csc.exe
    429 B
    219 B
    6
    5
  • 8.8.8.8:53
    araguatec.addns.org
    dns
    csc.exe
    65 B
    81 B
    1
    1

    DNS Request

    araguatec.addns.org

    DNS Response

    181.141.40.225

  • 8.8.8.8:53
    contath.org
    dns
    csc.exe
    57 B
    73 B
    1
    1

    DNS Request

    contath.org

    DNS Response

    69.49.234.173

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2132-17-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-0-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-3-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-6-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-5-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-7-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-4-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-11-0x0000000000400000-0x00000000006A9000-memory.dmp

    Filesize

    2.7MB

  • memory/2132-3936-0x000000000042F000-0x0000000000448000-memory.dmp

    Filesize

    100KB

  • memory/2132-1-0x000000000042F000-0x0000000000448000-memory.dmp

    Filesize

    100KB

  • memory/2820-69-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-59-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2820-8-0x0000000000080000-0x0000000000124000-memory.dmp

    Filesize

    656KB

  • memory/2820-13-0x0000000000080000-0x0000000000124000-memory.dmp

    Filesize

    656KB

  • memory/2820-20-0x0000000073FD0000-0x00000000746BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2820-21-0x0000000005030000-0x0000000005104000-memory.dmp

    Filesize

    848KB

  • memory/2820-22-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-23-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-27-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-39-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-51-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-25-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-71-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-19-0x0000000000080000-0x0000000000124000-memory.dmp

    Filesize

    656KB

  • memory/2820-67-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-65-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-63-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-62-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-10-0x0000000000080000-0x0000000000124000-memory.dmp

    Filesize

    656KB

  • memory/2820-57-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-55-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-53-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-49-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-47-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-45-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-43-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-41-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-37-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-35-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-33-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-31-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-29-0x0000000005030000-0x00000000050FE000-memory.dmp

    Filesize

    824KB

  • memory/2820-18-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

    Filesize

    4KB

  • memory/2820-3937-0x0000000000820000-0x0000000000876000-memory.dmp

    Filesize

    344KB

  • memory/2820-3938-0x0000000002380000-0x00000000023CC000-memory.dmp

    Filesize

    304KB

  • memory/2820-3939-0x0000000005100000-0x0000000005154000-memory.dmp

    Filesize

    336KB

  • memory/2820-3940-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

    Filesize

    4KB

  • memory/2820-3941-0x0000000073FD0000-0x00000000746BE000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.