Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2025, 06:49

General

  • Target

    940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe

  • Size

    28KB

  • MD5

    2f2f29b1fdc23c208eef50e0d1d7d8da

  • SHA1

    38aa1a47e500d98ac17ad711a9009bffb25ecfa4

  • SHA256

    940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b

  • SHA512

    f4c8cbc0476163a7de0a6156d2da15f649a2e786cca5b79e72d5c9c0ef105af3e90983f0353b800e5d4867059557f5df2f852988f524d6296aadb91980590e8c

  • SSDEEP

    384:2/mPAVyp+6srYYCk2gNPapIzFpOQGR9zos2clAKLHRN74u56/R9zZwu9P:J4quFCk2LeXOQ69zbjlAAX5e9zh

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 6 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 6 IoCs
  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe
    "C:\Users\Admin\AppData\Local\Temp\940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\{26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe
      C:\Windows\{26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\{DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe
        C:\Windows\{DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Windows\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe
          C:\Windows\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2908
          • C:\Windows\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe
            C:\Windows\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1576
            • C:\Windows\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe
              C:\Windows\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1112
              • C:\Windows\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe
                C:\Windows\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2228
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 252
                7⤵
                • Program crash
                PID:1848
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 252
              6⤵
              • Program crash
              PID:2532
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 252
            5⤵
            • Program crash
            PID:1896
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 252
          4⤵
          • Program crash
          PID:2904
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 252
        3⤵
        • Program crash
        PID:2616
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 252
      2⤵
      • Program crash
      PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\{26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe

    Filesize

    28KB

    MD5

    7820d9c4ea6cc293ae243f3c93d00b54

    SHA1

    c33c167b493d900575ad8f4bbd3dc04129d2b8a2

    SHA256

    07cdbd2e375e177ef2d4a3df624d4f58df5cf95be8a6e2a0c94a95740ad70a7a

    SHA512

    e9bce0c117e6300ed84c585891831cb3db647bb3a8ed82bb1a5597e27306ddd0c90c0f863a17bd910acc36b0c430eb849db63b8ce95b7633f34f652efab02664

  • C:\Windows\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe

    Filesize

    28KB

    MD5

    bf818a7879959a13d666b4321933b99e

    SHA1

    b58b92d0577406c5766ae3116c64e7d2d65d6403

    SHA256

    0264c8953dc8d5f63b0d01e9144f7e5c3ccb157a9b8fb6973f8cedea3dbd533b

    SHA512

    b03600a0fe035cfd0db5c28fe3b0ee5e678f22f0e982c8b37fdb606b2936a204233870db6acf12fb586286f0476d533b81b00637c35135082b5767c907d18c4d

  • C:\Windows\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe

    Filesize

    28KB

    MD5

    d11edc8572253f47acf2876d4859a862

    SHA1

    3ddf2181ede5892cc78623370c12724bd33e7e4b

    SHA256

    0f0ddd0be512cbd6bf6e90763877013285b29985053741637de9f03b32eae6de

    SHA512

    ea0e3f4bfca87fd61274e546595901ce5207145954a94af221be9983a630d601be611589aa1486d3175ee4655dcbd8a49a9fc9366c7f865e60d0cf90120ada25

  • C:\Windows\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe

    Filesize

    28KB

    MD5

    a798c82a5ae305cf6f953ef0d7c7c262

    SHA1

    670917430fdc209e0ef5fa60c3292b0958da582e

    SHA256

    2ee5a63a3b73ed289372d1a9a41d49199ca58ad5a48513ec8f374dc8556d6530

    SHA512

    4736c96c8f0a9bde21fce51bdd0499b6dfe69efb6d73486feeeb098814ef7a5d2f391c1038487ad38cb0e86e2aa048c76070fd151fe149fbb3efe4806e4b83d4

  • C:\Windows\{DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe

    Filesize

    28KB

    MD5

    9ae118fc6a7526be0dd648cf8a2287f2

    SHA1

    034a32ae28a7caaee1a853c9885451abf52586d5

    SHA256

    a70c9eb0eb701e73c91699baad062916cc110b4ad9af64074e9b9b0aa1652f55

    SHA512

    967e933d78218460a80bbba15e43101999e1d5e2a4d6fbfccbb1039933fafc533f8c98d87bbee7ba6e63c436311b9649ccbc28ead5f2ee417da7a2c6f7284651

  • C:\Windows\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe

    Filesize

    28KB

    MD5

    8a3d85e7fb427cb736e95521d0546eab

    SHA1

    074fd133a329c5790ce15a548bc02e65eea93eee

    SHA256

    0ffdfad1dd4e8f224d2ac612fe7bd93ae6c5e156fb984ca632811bce706f46ca

    SHA512

    10f3597a143c6ab4d1211378007dbd7cd64b1e6ce57c6ab55c6bbdbeb1a47c171bb28e2f083182b15748a0dc4416d186ab9b6871ee9520c9fc868699ab52b685

  • memory/1112-63-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1112-62-0x0000000000430000-0x0000000000442000-memory.dmp

    Filesize

    72KB

  • memory/1576-52-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1576-51-0x0000000001C30000-0x0000000001C42000-memory.dmp

    Filesize

    72KB

  • memory/2412-10-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2412-0-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2412-8-0x00000000002A0000-0x00000000002B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-4-0x00000000002A0000-0x00000000002B2000-memory.dmp

    Filesize

    72KB

  • memory/2412-1-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2548-30-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2548-19-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2748-20-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2908-39-0x00000000005B0000-0x00000000005C2000-memory.dmp

    Filesize

    72KB

  • memory/2908-41-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB