Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30/06/2023, 21:15
Behavioral task
behavioral1
Sample
ntokrnl.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
ntokrnl.exe
Resource
win10v2004-20230621-en
General
-
Target
ntokrnl.exe
-
Size
7.8MB
-
MD5
c19184bceaabb8ede17cf36c913345a4
-
SHA1
8cc33de9b25e1624e009dac03bbc229ee51c763d
-
SHA256
5732affc1ba8e455d627a9bb2356c89a4741959221ee491cc8200be84a538261
-
SHA512
e49bbb265d882cf72a422cd19a9d81d62d572fac77bd775799861aa89bdbd0ed6287b62928f9ccccda30fe4c048820a58789a28a0ce08dfebfe134218611e1f4
-
SSDEEP
196608:klMldQmRJ8dA6loVCy1ArqkVpKCX+PrF4ZIeghQiATF2MJh:6cdQusloVrAZYCuPJOIegtCQW
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1656 ntokrnl.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1656 1588 ntokrnl.exe 28 PID 1588 wrote to memory of 1656 1588 ntokrnl.exe 28 PID 1588 wrote to memory of 1656 1588 ntokrnl.exe 28
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD554f8267c6c116d7240f8e8cd3b241cd9
SHA1907b965b6ce502dad59cde70e486eb28c5517b42
SHA256c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
SHA512f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1
-
Filesize
4.3MB
MD554f8267c6c116d7240f8e8cd3b241cd9
SHA1907b965b6ce502dad59cde70e486eb28c5517b42
SHA256c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
SHA512f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1