Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
07/07/2023, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
5a08ded5458368exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
5a08ded5458368exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
5a08ded5458368exeexeexeex.exe
-
Size
58KB
-
MD5
5a08ded54583683f9bc317a2f3923905
-
SHA1
7b0dd1bd35a74b1212d0332404284b01fb366e5b
-
SHA256
dc60ba75ab28673636dfb2bd57a65261c9841f94ff20c15c24e323f2e749876b
-
SHA512
85c971de1ad7f3aa6ec90e1eed181cc6a09001689fa10b48ebdd67ac3a84d905e4ac1dab134daf723184e0e3b63ca236ea9d364c37bfdd7a557f238c09f16ac7
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrY:i5nkFGMOtEvwDpjNbwQEIs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2368 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2292 5a08ded5458368exeexeexeex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2368 2292 5a08ded5458368exeexeexeex.exe 29 PID 2292 wrote to memory of 2368 2292 5a08ded5458368exeexeexeex.exe 29 PID 2292 wrote to memory of 2368 2292 5a08ded5458368exeexeexeex.exe 29 PID 2292 wrote to memory of 2368 2292 5a08ded5458368exeexeexeex.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a08ded5458368exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\5a08ded5458368exeexeexeex.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2368
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD598cbda19a59a6ba571a3fe1afbab66ff
SHA19f077fb429a7b0150d0813fba8e38614dbb88733
SHA256d3419045232aa512edd72193a01d2227cf3924ce17f6beefd705882e7a42af61
SHA512c066faa133f5145bf2e4cf6c9afa33e9943c8db8f1f1fdbc6aa1b0ef3f7a0676bc88e39eb373740a3c0a185794d1ce90a0ce0b892edc672999f45f6f9105b9bb
-
Filesize
58KB
MD598cbda19a59a6ba571a3fe1afbab66ff
SHA19f077fb429a7b0150d0813fba8e38614dbb88733
SHA256d3419045232aa512edd72193a01d2227cf3924ce17f6beefd705882e7a42af61
SHA512c066faa133f5145bf2e4cf6c9afa33e9943c8db8f1f1fdbc6aa1b0ef3f7a0676bc88e39eb373740a3c0a185794d1ce90a0ce0b892edc672999f45f6f9105b9bb
-
Filesize
58KB
MD598cbda19a59a6ba571a3fe1afbab66ff
SHA19f077fb429a7b0150d0813fba8e38614dbb88733
SHA256d3419045232aa512edd72193a01d2227cf3924ce17f6beefd705882e7a42af61
SHA512c066faa133f5145bf2e4cf6c9afa33e9943c8db8f1f1fdbc6aa1b0ef3f7a0676bc88e39eb373740a3c0a185794d1ce90a0ce0b892edc672999f45f6f9105b9bb