Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10/02/2023, 08:07
Static task
static1
Behavioral task
behavioral1
Sample
CiscoPacketTracer_820_Windows_64bit.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
CiscoPacketTracer_820_Windows_64bit.exe
Resource
win10v2004-20221111-en
General
-
Target
CiscoPacketTracer_820_Windows_64bit.exe
-
Size
223.3MB
-
MD5
66d5133f95f9ea6aefd1f439fab02be6
-
SHA1
ddbc262abd68dc5e10170310a5f5cfdf37912c89
-
SHA256
968bdbfe007fcfbc669643510a45e133a19d92bf3a27d8e6267758a633c48885
-
SHA512
74491cc79eaa72da0e07fc6ea11adf711f9fd1a52cd84e1796a8797acbefdfb7f0d33ad3dd60311bfea0dc6ff59ab9434e467b8c98ccbff78b52086a69745ff2
-
SSDEEP
6291456:4wPRmjrOtnZ4Wix4WwqVPgciIPIGI6DAfFu:UjStnZ4Wi7wKwzzu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 948 CiscoPacketTracer_820_Windows_64bit.tmp -
Loads dropped DLL 1 IoCs
pid Process 1100 CiscoPacketTracer_820_Windows_64bit.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1100 wrote to memory of 948 1100 CiscoPacketTracer_820_Windows_64bit.exe 28 PID 1100 wrote to memory of 948 1100 CiscoPacketTracer_820_Windows_64bit.exe 28 PID 1100 wrote to memory of 948 1100 CiscoPacketTracer_820_Windows_64bit.exe 28 PID 1100 wrote to memory of 948 1100 CiscoPacketTracer_820_Windows_64bit.exe 28 PID 1100 wrote to memory of 948 1100 CiscoPacketTracer_820_Windows_64bit.exe 28 PID 1100 wrote to memory of 948 1100 CiscoPacketTracer_820_Windows_64bit.exe 28 PID 1100 wrote to memory of 948 1100 CiscoPacketTracer_820_Windows_64bit.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\CiscoPacketTracer_820_Windows_64bit.exe"C:\Users\Admin\AppData\Local\Temp\CiscoPacketTracer_820_Windows_64bit.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\is-LLL8R.tmp\CiscoPacketTracer_820_Windows_64bit.tmp"C:\Users\Admin\AppData\Local\Temp\is-LLL8R.tmp\CiscoPacketTracer_820_Windows_64bit.tmp" /SL5="$8001C,233583460,121344,C:\Users\Admin\AppData\Local\Temp\CiscoPacketTracer_820_Windows_64bit.exe"2⤵
- Executes dropped EXE
PID:948
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c