Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe
Resource
win10v2004-20220901-en
General
-
Target
18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe
-
Size
500KB
-
MD5
58be79e04e910cdc25d0353728f95d60
-
SHA1
e333cf6455416da942cd77a86c40b5b4f55a1a63
-
SHA256
18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4
-
SHA512
950787d67e33d113c0bb727a5039ddcb4ff7f336fd1e65c79f803105cb76b0c5f89a518e78b742af4973970aacd25a825ae8b8af5e192cc2e49abd592612c15d
-
SSDEEP
12288:5MTb0PQ0vyj70pGufmLNMZZW/an1sVsz/:CTb0PQ0vI0LmLiLWCn1
Malware Config
Signatures
-
Kills process with taskkill 1 IoCs
pid Process 2040 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1824 PING.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1712 18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe"C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1712 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\18116aac4470904dc57347eab2466421eccfb53962f4a2c782969e495763c2b4.exe" & start C:\Users\Admin\AppData\Local\JNPXMB~1.EXE -f2⤵PID:2024
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:1824
-
-
C:\Users\Admin\AppData\Local\jnpxmbmea.exeC:\Users\Admin\AppData\Local\JNPXMB~1.EXE -f3⤵PID:520
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 17121⤵
- Kills process with taskkill
PID:2040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD57aa4d9e242d437f0ae7472a94565e0cf
SHA130de37ca0243ac7c0733b518816098543556ebfc
SHA2567d939e4af226deb56b83df2f3b26c1a24adcb46d5087a20c7668f13077215b28
SHA51299e43c3f68d36da923a65d1c18ce36e461581816d9cf9e2d1094a282d160cba4c8e3d6185a0cd4b74f6d2d699d9610ee1bb720c5942a64778385fbade34aad4a
-
Filesize
16KB
MD5dde25b695734f4b047572428434acf9c
SHA129aa394ebd7cbd92689c08ccee155a64fcf0e0a6
SHA25664c2504b9e699e81753df8f7d3d4ee5653a2caa922c6fba5f6e68ef83d76ef3d
SHA512d633c4d12ef474db950a227ebfc26a6f250a1750b8cb97a7f3e2e4e21dd3d2cccf38578c31b4ee616a1f6d1ec0138a721f582ec31d617605d623a065e08e8ae6
-
Filesize
21KB
MD590b1b0764f93e38aaca946ed5d03797c
SHA1dc4aacfde12b27c06bfc389a4cfe4e6fdfe8c899
SHA256b752af84e3e24a0670412cdcbd6786db806413658c757de01ad2f8a0f8a0a422
SHA512176f8003d19f58925389591a52a1b9609a0c999fafe9cb0f110d28af00aed2b36d8625f3c19dee907f6a7180b2243d10cf088e330514dc384deae0150b9e1038
-
Filesize
28KB
MD51d10ea226b7f34e3a9a70f1a5563e8fd
SHA12266185822d46fa6b6ffc022f1ab0c508b07568a
SHA256d475b4fd671468871cc883bcad813fefa725a306b3a02f2b0d08df4df4a39424
SHA512138dda9803746b12224ed01317483eafb9f566f8b0eefa60838e6a2cfb5a18f2867dea7164f0925fcaa1d501b1b9164852d2557d3889c0f8fac4732771d729be