Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/07/2023, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
61314bf6c6740a_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
61314bf6c6740a_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
61314bf6c6740a_JC.exe
-
Size
29KB
-
MD5
61314bf6c6740ae927e63c763a69c5da
-
SHA1
204d27614f1358cbd3629628c8089d9ee24d92b7
-
SHA256
28772098142f68d8c14fa252c98a63c3eb7278bced6317d8a87ff3607065a2db
-
SHA512
3814cbe82c17b66036abb8faf2787e57b1c4d75d17770128718985fd88df4a08f3b4fc7858fffcd2b17cde584c3f90efe74a60c82bb7a5539c96266f7a6fc210
-
SSDEEP
384:bIDl1ovmXAw9PMDREhi9OUSPlRxMc/cip7IAfjDb4H0g/X2kH9r5GJ:bIDOw9UiaCHfjnE0S2kH9rYJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2428 lossy.exe -
Loads dropped DLL 1 IoCs
pid Process 1996 61314bf6c6740a_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2428 1996 61314bf6c6740a_JC.exe 28 PID 1996 wrote to memory of 2428 1996 61314bf6c6740a_JC.exe 28 PID 1996 wrote to memory of 2428 1996 61314bf6c6740a_JC.exe 28 PID 1996 wrote to memory of 2428 1996 61314bf6c6740a_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\61314bf6c6740a_JC.exe"C:\Users\Admin\AppData\Local\Temp\61314bf6c6740a_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
PID:2428
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD54d2a6ecd492b561584853ac853eca91c
SHA128299607bea7461efe2aff9d29efe916722b89a6
SHA25631b2345e3a5ddb802faa9785780dfe304580907141fe52ea8ea4b40e239cd7ba
SHA5129eaa202e952dfccb8484e325960c5f2d8eb1f6e598422eaf262f6020d1d68746cf985eb662a7b03cda3f67ffc72c775b892c8a18849ef0e8fed63f8557e7ab42
-
Filesize
29KB
MD54d2a6ecd492b561584853ac853eca91c
SHA128299607bea7461efe2aff9d29efe916722b89a6
SHA25631b2345e3a5ddb802faa9785780dfe304580907141fe52ea8ea4b40e239cd7ba
SHA5129eaa202e952dfccb8484e325960c5f2d8eb1f6e598422eaf262f6020d1d68746cf985eb662a7b03cda3f67ffc72c775b892c8a18849ef0e8fed63f8557e7ab42
-
Filesize
29KB
MD54d2a6ecd492b561584853ac853eca91c
SHA128299607bea7461efe2aff9d29efe916722b89a6
SHA25631b2345e3a5ddb802faa9785780dfe304580907141fe52ea8ea4b40e239cd7ba
SHA5129eaa202e952dfccb8484e325960c5f2d8eb1f6e598422eaf262f6020d1d68746cf985eb662a7b03cda3f67ffc72c775b892c8a18849ef0e8fed63f8557e7ab42