Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:25

General

  • Target

    34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe

  • Size

    580KB

  • MD5

    8cfc3f50d92b1919d85306fa26d53a73

  • SHA1

    9bcdae674f2508df2e9c98fe441d4e0fa9bb85e4

  • SHA256

    34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4

  • SHA512

    04c62010776379fb46f90081db7cc4040ccaae373610475088fd891bc487d8e3a4c7396d73a1941538c398bd639b04d1e9cd0271ed596eaa80cd2b62162dff55

  • SSDEEP

    12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7J:rBJwdhMJ6ZzHrfcsMGTfZ5PJ

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe
      "C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"
      2⤵
      • Executes dropped EXE
      PID:2948
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:940
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:2880

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe

        Filesize

        580KB

        MD5

        36b242fc2bbe7b8f16e3eafbe31cab71

        SHA1

        851fd6432186c103c55c23077c8d45bca51dc148

        SHA256

        3860e2f33e606f44ee0a618ca45713c12146edc3572302afc7586ea3675fc1e4

        SHA512

        14c1046352bd202075148715ff8fdbbb7c09d96418819e7d16a99ebc19a2fe28c5c0ddd2c56a8854f415caa03d0200aefb926579bddd477da7d463169d014f0f

      • memory/940-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/940-20-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/940-21-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/940-22-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/940-23-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/940-30-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/940-26-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/940-33-0x0000000000360000-0x0000000000388000-memory.dmp

        Filesize

        160KB

      • memory/940-32-0x0000000000EA0000-0x0000000000F4E000-memory.dmp

        Filesize

        696KB

      • memory/940-34-0x0000000000530000-0x0000000000546000-memory.dmp

        Filesize

        88KB

      • memory/940-31-0x00000000001E0000-0x00000000001F0000-memory.dmp

        Filesize

        64KB

      • memory/940-28-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/1364-14-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB

      • memory/1364-0-0x00000000741AE000-0x00000000741AF000-memory.dmp

        Filesize

        4KB

      • memory/1364-5-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB

      • memory/1364-4-0x00000000741AE000-0x00000000741AF000-memory.dmp

        Filesize

        4KB

      • memory/1364-2-0x00000000005D0000-0x00000000005DA000-memory.dmp

        Filesize

        40KB

      • memory/1364-3-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB

      • memory/1364-1-0x00000000002E0000-0x0000000000374000-memory.dmp

        Filesize

        592KB

      • memory/2948-19-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB

      • memory/2948-18-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB

      • memory/2948-15-0x0000000001100000-0x0000000001194000-memory.dmp

        Filesize

        592KB

      • memory/2948-17-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB

      • memory/2948-16-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB

      • memory/2948-36-0x00000000741A0000-0x000000007488E000-memory.dmp

        Filesize

        6.9MB