Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
15/07/2023, 20:01
General
-
Target
Decent_Sampler-1.8.12.0-Windows.exe
-
Size
31.7MB
-
MD5
1fb5e8893336b758740944ea0f2965a8
-
SHA1
8a849d422806fac01693ef44402bdf9ec14d34ba
-
SHA256
8ffc45ed98a4e16a0e2e58eb9e35f6f73a3a7520adb2e7e9360d7acead3a5f8c
-
SHA512
61acb91b0eaeb452604bcddf3004c37aafdd01d89b9532b40a4471a975414c3531eff9ae43243b1ccc418b64e59c5ae8d4bcebb6a7a0cd9874a7274d6537b44d
-
SSDEEP
786432:t+CMjkyOX0+Q/JQViulnYrsDDc4u3Mwh1+G1opCMi2KH:5GLGkWViu6I3Fw04oQMi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 14 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JR9LK.tmp\Decent_Sampler-1.8.12.0-Windows.tmp"C:\Users\Admin\AppData\Local\Temp\is-JR9LK.tmp\Decent_Sampler-1.8.12.0-Windows.tmp" /SL5="$80122,32361468,831488,C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5bbd72aa568e9f2c3e67f5c6db24e9d3e
SHA15a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3
SHA256ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e
SHA512f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741
-
Filesize
3.0MB
MD5bbd72aa568e9f2c3e67f5c6db24e9d3e
SHA15a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3
SHA256ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e
SHA512f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741
-
Filesize
3.1MB
MD58a54aa9cbfa07bd0400258b60aa22fb8
SHA173a6fda9a8d2ccbe041a435706e2fa9090aaa89c
SHA256af114b34c9c332e19cc9ddc205999924a2cb5d46d7a213ec87d3679f778b05b5
SHA5123e98a46144461584f3f4d8f37dc777576fa0d831240dfc02e60d7e6d2d18fa769bbac58888410d96c5035ce0effbc8539d681daf1ba97add746a6bb4f3873da1
-
Filesize
3.0MB
MD5bbd72aa568e9f2c3e67f5c6db24e9d3e
SHA15a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3
SHA256ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e
SHA512f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB