Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
14/07/2023, 15:05
Behavioral task
behavioral1
Sample
248cfd01674724exeexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
248cfd01674724exeexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
248cfd01674724exeexe_JC.exe
-
Size
89KB
-
MD5
248cfd016747245fe3d5521d87a684c5
-
SHA1
8ef79f14e2d4ce556e9d6da0614822a5538ebf6a
-
SHA256
5326f4e00f9c860e2200cbd368f50efe5912853c7cf1416c7257310ba2512860
-
SHA512
042f0d1cf5a9781b2544a4db3ecc2ee6b3a01fe3045fc25dd6349826bb834e16baa3f1a9c5f0065bfb889273ffb1221be32e6f1069749757852aa764d87f86f5
-
SSDEEP
1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpMx7I:AnBdOOtEvwDpj6zI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2376 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2988 248cfd01674724exeexe_JC.exe -
resource yara_rule behavioral1/memory/2988-54-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/files/0x0008000000012029-65.dat upx behavioral1/memory/2988-69-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2376-71-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/files/0x0008000000012029-70.dat upx behavioral1/files/0x0008000000012029-80.dat upx behavioral1/memory/2376-82-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2376 2988 248cfd01674724exeexe_JC.exe 28 PID 2988 wrote to memory of 2376 2988 248cfd01674724exeexe_JC.exe 28 PID 2988 wrote to memory of 2376 2988 248cfd01674724exeexe_JC.exe 28 PID 2988 wrote to memory of 2376 2988 248cfd01674724exeexe_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\248cfd01674724exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\248cfd01674724exeexe_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2376
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5300d086e4fc71f67174074b7271c6cb1
SHA12d3e5106716ec96d7c9ab568757d50a8974d32b2
SHA25620f0649a112eb6c2ce4f9e0c15ed062c519a93e094aefc36e38d07fa6caac26e
SHA51202f26bfd7ed08f1bc8173760aa7316c1326e22245cc68aecd70f9b35e284833eaba9bc32b2a3c1ebe2dff62c24e86eb750df7b2518805457f498491b52ff5837
-
Filesize
89KB
MD5300d086e4fc71f67174074b7271c6cb1
SHA12d3e5106716ec96d7c9ab568757d50a8974d32b2
SHA25620f0649a112eb6c2ce4f9e0c15ed062c519a93e094aefc36e38d07fa6caac26e
SHA51202f26bfd7ed08f1bc8173760aa7316c1326e22245cc68aecd70f9b35e284833eaba9bc32b2a3c1ebe2dff62c24e86eb750df7b2518805457f498491b52ff5837
-
Filesize
89KB
MD5300d086e4fc71f67174074b7271c6cb1
SHA12d3e5106716ec96d7c9ab568757d50a8974d32b2
SHA25620f0649a112eb6c2ce4f9e0c15ed062c519a93e094aefc36e38d07fa6caac26e
SHA51202f26bfd7ed08f1bc8173760aa7316c1326e22245cc68aecd70f9b35e284833eaba9bc32b2a3c1ebe2dff62c24e86eb750df7b2518805457f498491b52ff5837