Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe
Resource
win10v2004-20220812-en
General
-
Target
9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe
-
Size
61KB
-
MD5
0c9e456c594b4c7b025fd03179a57060
-
SHA1
289c947ca18e55d400b718632459b9a33d1a5488
-
SHA256
9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47
-
SHA512
a49393693f0aacee8a10dbff47a1efc9ea645883fd7f571bba3bd569b9e6e20f2bf2e471ef8a4b7a9f41068494743612008dc42f767507052bd710491b5dc388
-
SSDEEP
1536:JRw2JFBYdLxq1KiULHN103koGIHG9kNo:bwLmULHfqW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1832 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 936 cmd.exe 936 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1104 wrote to memory of 936 1104 9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe 28 PID 1104 wrote to memory of 936 1104 9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe 28 PID 1104 wrote to memory of 936 1104 9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe 28 PID 1104 wrote to memory of 936 1104 9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe 28 PID 936 wrote to memory of 1832 936 cmd.exe 29 PID 936 wrote to memory of 1832 936 cmd.exe 29 PID 936 wrote to memory of 1832 936 cmd.exe 29 PID 936 wrote to memory of 1832 936 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe"C:\Users\Admin\AppData\Local\Temp\9713c8658bad9ba062792aedcf237cfb2c44be009b6d926f2b7c3951e065ae47.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:1832
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize61KB
MD596fbab6bc4fe1c99bd578568ea7484ea
SHA1ee163364004910e897372d6144069c01f7d73217
SHA25618280a62cc339998ec852d23ce5075629a31dd782e621f9955148ed1ee3da2bb
SHA512c37a3f66c559d72881d8820878ec8e2374748b990fa51fa466ecc1b6d6d7a53a842164e169b516900b9676133f7a362df8c4990418764b6ca41c50f14a43b51f
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize61KB
MD596fbab6bc4fe1c99bd578568ea7484ea
SHA1ee163364004910e897372d6144069c01f7d73217
SHA25618280a62cc339998ec852d23ce5075629a31dd782e621f9955148ed1ee3da2bb
SHA512c37a3f66c559d72881d8820878ec8e2374748b990fa51fa466ecc1b6d6d7a53a842164e169b516900b9676133f7a362df8c4990418764b6ca41c50f14a43b51f
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize61KB
MD596fbab6bc4fe1c99bd578568ea7484ea
SHA1ee163364004910e897372d6144069c01f7d73217
SHA25618280a62cc339998ec852d23ce5075629a31dd782e621f9955148ed1ee3da2bb
SHA512c37a3f66c559d72881d8820878ec8e2374748b990fa51fa466ecc1b6d6d7a53a842164e169b516900b9676133f7a362df8c4990418764b6ca41c50f14a43b51f
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize61KB
MD596fbab6bc4fe1c99bd578568ea7484ea
SHA1ee163364004910e897372d6144069c01f7d73217
SHA25618280a62cc339998ec852d23ce5075629a31dd782e621f9955148ed1ee3da2bb
SHA512c37a3f66c559d72881d8820878ec8e2374748b990fa51fa466ecc1b6d6d7a53a842164e169b516900b9676133f7a362df8c4990418764b6ca41c50f14a43b51f