Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230705-en -
resource tags
arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2023, 17:12
Static task
static1
Behavioral task
behavioral1
Sample
87598d9cc4bc46exeexeexeex.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
87598d9cc4bc46exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
87598d9cc4bc46exeexeexeex.exe
-
Size
56KB
-
MD5
87598d9cc4bc46228fe863d40296382b
-
SHA1
84f2de7adbd8d48073d4f3968aa1a899a3170388
-
SHA256
2fc3008e382feea9f678636409b1ca9932cbc4e01260acb6541a12828ffec214
-
SHA512
a927e920ce0244bea255a477be168c93be8c40f13c76a7bf0f179f2b786b265e8793a60240f15c627e9ae91e66a1924a237287285360f49e829cf6cc62493fa0
-
SSDEEP
768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeo9e1jR4llT:ZzFbxmLPWQMOtEvwDpj38lD/cMAPm8lT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2000 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2192 87598d9cc4bc46exeexeexeex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2000 2192 87598d9cc4bc46exeexeexeex.exe 27 PID 2192 wrote to memory of 2000 2192 87598d9cc4bc46exeexeexeex.exe 27 PID 2192 wrote to memory of 2000 2192 87598d9cc4bc46exeexeexeex.exe 27 PID 2192 wrote to memory of 2000 2192 87598d9cc4bc46exeexeexeex.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\87598d9cc4bc46exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\87598d9cc4bc46exeexeexeex.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2000
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5e0e3d8daa0f830b497492b4b022e28cb
SHA1c459e7e6d291b0b31e35e6ae6bb828a85b3cf246
SHA256c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d
SHA512fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635
-
Filesize
56KB
MD5e0e3d8daa0f830b497492b4b022e28cb
SHA1c459e7e6d291b0b31e35e6ae6bb828a85b3cf246
SHA256c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d
SHA512fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635
-
Filesize
56KB
MD5e0e3d8daa0f830b497492b4b022e28cb
SHA1c459e7e6d291b0b31e35e6ae6bb828a85b3cf246
SHA256c21e5ce20408d45dae68a106f2699f3ac197ea01b5be3ef74923f8a653b78e5d
SHA512fdf659833473e07c667757c50b565654fbd9250278a78ffa85fc320152e9cc4c2226a608f61c5d41837a3e1db2e429852fa502bd0b08294b99a9dcae91ca1635