Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/07/2023, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
6f7a2f95ad112a_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6f7a2f95ad112a_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
6f7a2f95ad112a_JC.exe
-
Size
90KB
-
MD5
6f7a2f95ad112a880a08985e40a63578
-
SHA1
fb4028b94af051a6da7dd157503900987372c00a
-
SHA256
51710ef7314fee8645620d87e09e005c4de895160974f8f98d7bdf79934b5d23
-
SHA512
ac49c556fdbc592468a0c0bc475ac1ce5eaf4912bba75c62ce896f0b83717d479095c9d0f60a90b050d273054ea66b5775a3214adf0ebfb1fd4d3484953f8522
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvWLmD:V6a+pOtEvwDpjtJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2832 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2548 6f7a2f95ad112a_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2832 2548 6f7a2f95ad112a_JC.exe 28 PID 2548 wrote to memory of 2832 2548 6f7a2f95ad112a_JC.exe 28 PID 2548 wrote to memory of 2832 2548 6f7a2f95ad112a_JC.exe 28 PID 2548 wrote to memory of 2832 2548 6f7a2f95ad112a_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7a2f95ad112a_JC.exe"C:\Users\Admin\AppData\Local\Temp\6f7a2f95ad112a_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2832
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5132bcec38c87d8ae6b8b25f285ac44c5
SHA11576de1e861dd7f0da19e7e9be95791c42b8cd3c
SHA256717a4807ec2e68e159d111b797a089635179ca43bd1af31b724b14a29c3e6ee5
SHA51269c60dadaad7ccea8bca1f81a94d274593c1e61d3e0894a7e64056f4411886c8a62885d61c05c9ceac5b74fc38de8203128b7e22a67f567a9a783c4355c9ee36
-
Filesize
90KB
MD5132bcec38c87d8ae6b8b25f285ac44c5
SHA11576de1e861dd7f0da19e7e9be95791c42b8cd3c
SHA256717a4807ec2e68e159d111b797a089635179ca43bd1af31b724b14a29c3e6ee5
SHA51269c60dadaad7ccea8bca1f81a94d274593c1e61d3e0894a7e64056f4411886c8a62885d61c05c9ceac5b74fc38de8203128b7e22a67f567a9a783c4355c9ee36
-
Filesize
90KB
MD5132bcec38c87d8ae6b8b25f285ac44c5
SHA11576de1e861dd7f0da19e7e9be95791c42b8cd3c
SHA256717a4807ec2e68e159d111b797a089635179ca43bd1af31b724b14a29c3e6ee5
SHA51269c60dadaad7ccea8bca1f81a94d274593c1e61d3e0894a7e64056f4411886c8a62885d61c05c9ceac5b74fc38de8203128b7e22a67f567a9a783c4355c9ee36