Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
416s -
max time network
419s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/05/2023, 17:56
Behavioral task
behavioral1
Sample
New_Badge_Guide.pdf.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
New_Badge_Guide.pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
New_Badge_Guide.pdf.exe
Resource
win10v2004-20230220-en
General
-
Target
New_Badge_Guide.pdf.exe
-
Size
17.7MB
-
MD5
db13bc7146d21a616f51b4799ae2f93f
-
SHA1
13ee7aad2a761158e72082d22651e634ca91d4b3
-
SHA256
683ce5a6c98c7214f598ac3a95356f31d9b17f55ca94b292ededb2fe78c7afd1
-
SHA512
0f25b15de18a332359e476e4998bb661fa207d7668ce2e5812e8415a696622a010228e81a62a1cc403de7f2aba368ac3aacac8977dc592f64b1d37af2f8ab17a
-
SSDEEP
393216:rqPnLFXlrjQpDOETgsvfGACgIWvEn4DghLSW:+PLFXNjQoEizvQk
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1656 New_Badge_Guide.pdf.exe -
resource yara_rule behavioral2/files/0x0006000000016c9c-166.dat upx behavioral2/files/0x0006000000016c9c-167.dat upx behavioral2/memory/1656-168-0x000007FEF5E20000-0x000007FEF628E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1656 1324 New_Badge_Guide.pdf.exe 28 PID 1324 wrote to memory of 1656 1324 New_Badge_Guide.pdf.exe 28 PID 1324 wrote to memory of 1656 1324 New_Badge_Guide.pdf.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\New_Badge_Guide.pdf.exe"C:\Users\Admin\AppData\Local\Temp\New_Badge_Guide.pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\New_Badge_Guide.pdf.exe"C:\Users\Admin\AppData\Local\Temp\New_Badge_Guide.pdf.exe"2⤵
- Loads dropped DLL
PID:1656
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378