Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13/07/2023, 19:15
Behavioral task
behavioral1
Sample
0ad91315474087exe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0ad91315474087exe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
0ad91315474087exe_JC.exe
-
Size
47KB
-
MD5
0ad9131547408749e0231f19d6df23e2
-
SHA1
6df594d124de3b7c4dbeddb1627aafae8a58bb93
-
SHA256
db46ce31d874bd4d81a938e7e05267da489fcb6319d0f949baea02aae378d90c
-
SHA512
7b85d75f698155bdac60a3bc871da7bc7bc3e41a34ad3c9c554e5943d25c2360acc5095b2ed25867194e729ea581bfde79faf3a20a3c87fd3185b9386af220aa
-
SSDEEP
768:P8mnjO6LsoEEeegiZPvEhHSG+gbum/kLyMro2GtOOtEvwDpjKvC:P8mnK6QFElP6n+gymddpMOtEvwDpjV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2804 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2588 0ad91315474087exe_JC.exe -
resource yara_rule behavioral1/memory/2588-54-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x00080000000120e6-65.dat upx behavioral1/memory/2588-69-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x00080000000120e6-68.dat upx behavioral1/memory/2804-71-0x0000000000500000-0x000000000050F311-memory.dmp upx behavioral1/files/0x00080000000120e6-80.dat upx behavioral1/memory/2804-82-0x0000000000500000-0x000000000050F311-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2588 wrote to memory of 2804 2588 0ad91315474087exe_JC.exe 28 PID 2588 wrote to memory of 2804 2588 0ad91315474087exe_JC.exe 28 PID 2588 wrote to memory of 2804 2588 0ad91315474087exe_JC.exe 28 PID 2588 wrote to memory of 2804 2588 0ad91315474087exe_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ad91315474087exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\0ad91315474087exe_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2804
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD519dcb97eadaba3e2df812bee1625faf9
SHA1cb47caccf55d8d6bba03b219afbacef3f3f38fc1
SHA256e72340fc857c08478e8e16768dcb2a1a80a8748a17046d5f7bbcfa2937ec5bfc
SHA5120f709a5f5ffefd949ba99de490d09b42b4824abe435bbf71ffc42fdac2d6f3cfe0c4637c928fbed334f35fa8347e1558350ec130dc71477de6864aeadc2002f2
-
Filesize
47KB
MD519dcb97eadaba3e2df812bee1625faf9
SHA1cb47caccf55d8d6bba03b219afbacef3f3f38fc1
SHA256e72340fc857c08478e8e16768dcb2a1a80a8748a17046d5f7bbcfa2937ec5bfc
SHA5120f709a5f5ffefd949ba99de490d09b42b4824abe435bbf71ffc42fdac2d6f3cfe0c4637c928fbed334f35fa8347e1558350ec130dc71477de6864aeadc2002f2
-
Filesize
47KB
MD519dcb97eadaba3e2df812bee1625faf9
SHA1cb47caccf55d8d6bba03b219afbacef3f3f38fc1
SHA256e72340fc857c08478e8e16768dcb2a1a80a8748a17046d5f7bbcfa2937ec5bfc
SHA5120f709a5f5ffefd949ba99de490d09b42b4824abe435bbf71ffc42fdac2d6f3cfe0c4637c928fbed334f35fa8347e1558350ec130dc71477de6864aeadc2002f2