Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 03:06
Behavioral task
behavioral1
Sample
e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe
Resource
win10v2004-20221111-en
General
-
Target
e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe
-
Size
857KB
-
MD5
fea02960bc9f941720163c099e7a852b
-
SHA1
0bc7cbdcc6714afd71288a501aebf40401a82436
-
SHA256
e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345
-
SHA512
f11bb68005dcb89c22e8824ec97692a0f6fb450c4aa410f93ff2478011de9065e179689c35ac40c4174bd008b82e4dbbf652e05c4c76d7a2f4f6707bcac078ec
-
SSDEEP
24576:KH69UBaacw5mgbyZ97CBN1zAjqrZ0MGCMe+:KHi2DcM5byZ97edaq9lML
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 624 apocalyps32.exe 944 apocalyps32.exe -
resource yara_rule behavioral1/memory/2032-57-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/896-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-69-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/896-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/files/0x0009000000014124-78.dat upx behavioral1/memory/896-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/files/0x0009000000014124-72.dat upx behavioral1/memory/624-79-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/files/0x0009000000014124-88.dat upx behavioral1/memory/944-94-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral1/memory/944-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-98-0x0000000000400000-0x00000000004E8000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 624 apocalyps32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\jurajura.dll e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2032 set thread context of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 624 set thread context of 944 624 apocalyps32.exe 29 -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe File opened for modification C:\Windows\apocalyps32.exe e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe File opened for modification C:\Windows\apocalyps32.exe apocalyps32.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 624 apocalyps32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 2032 wrote to memory of 896 2032 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 27 PID 896 wrote to memory of 624 896 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 28 PID 896 wrote to memory of 624 896 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 28 PID 896 wrote to memory of 624 896 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 28 PID 896 wrote to memory of 624 896 e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe 28 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 624 wrote to memory of 944 624 apocalyps32.exe 29 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30 PID 944 wrote to memory of 920 944 apocalyps32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe"C:\Users\Admin\AppData\Local\Temp\e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe"C:\Users\Admin\AppData\Local\Temp\e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\apocalyps32.exe-bs3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\apocalyps32.exe"C:\Windows\apocalyps32.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:920
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2292972927-2705560509-2768824231-1000\88603cb2913a7df3fbd16b5f958e6447_4339b52c-c4ea-4bc4-b41f-93efca473d02
Filesize51B
MD55fc2ac2a310f49c14d195230b91a8885
SHA190855cc11136ba31758fe33b5cf9571f9a104879
SHA256374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092
SHA512ab46554df9174b9fe9beba50a640f67534c3812f64d96a1fb8adfdc136dfe730ca2370825cd45b7f87a544d6a58dd868cb5a3a7f42e2789f6d679dbc0fdd52c3
-
Filesize
1.3MB
MD57103b491fd8fffd7c490a1f50822c15e
SHA171aad40d7bfea00f67460b44cb53e8886ff17a8e
SHA2566491e3617a0c7b08f59c01a6df16a4685399ccf53668a3b60701fd82c8c368c6
SHA512e6ae3be675fe569cc6263726cb794f8a80228b9f5ca2dd01ee5cc48c6b7774819670e913f14f34032e760e148f9fb8faf865b59a347eacb7eaab3bedc823429c
-
Filesize
857KB
MD5fea02960bc9f941720163c099e7a852b
SHA10bc7cbdcc6714afd71288a501aebf40401a82436
SHA256e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345
SHA512f11bb68005dcb89c22e8824ec97692a0f6fb450c4aa410f93ff2478011de9065e179689c35ac40c4174bd008b82e4dbbf652e05c4c76d7a2f4f6707bcac078ec
-
Filesize
857KB
MD5fea02960bc9f941720163c099e7a852b
SHA10bc7cbdcc6714afd71288a501aebf40401a82436
SHA256e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345
SHA512f11bb68005dcb89c22e8824ec97692a0f6fb450c4aa410f93ff2478011de9065e179689c35ac40c4174bd008b82e4dbbf652e05c4c76d7a2f4f6707bcac078ec
-
Filesize
857KB
MD5fea02960bc9f941720163c099e7a852b
SHA10bc7cbdcc6714afd71288a501aebf40401a82436
SHA256e93de9126bb87f8cd3168b4dca960c2ced2f008eff86a84e8f8b62dc7fa1f345
SHA512f11bb68005dcb89c22e8824ec97692a0f6fb450c4aa410f93ff2478011de9065e179689c35ac40c4174bd008b82e4dbbf652e05c4c76d7a2f4f6707bcac078ec
-
Filesize
1.3MB
MD57103b491fd8fffd7c490a1f50822c15e
SHA171aad40d7bfea00f67460b44cb53e8886ff17a8e
SHA2566491e3617a0c7b08f59c01a6df16a4685399ccf53668a3b60701fd82c8c368c6
SHA512e6ae3be675fe569cc6263726cb794f8a80228b9f5ca2dd01ee5cc48c6b7774819670e913f14f34032e760e148f9fb8faf865b59a347eacb7eaab3bedc823429c
-
Filesize
1.3MB
MD57103b491fd8fffd7c490a1f50822c15e
SHA171aad40d7bfea00f67460b44cb53e8886ff17a8e
SHA2566491e3617a0c7b08f59c01a6df16a4685399ccf53668a3b60701fd82c8c368c6
SHA512e6ae3be675fe569cc6263726cb794f8a80228b9f5ca2dd01ee5cc48c6b7774819670e913f14f34032e760e148f9fb8faf865b59a347eacb7eaab3bedc823429c