Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/07/2023, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
6e49e7126b5745_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6e49e7126b5745_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
6e49e7126b5745_JC.exe
-
Size
63KB
-
MD5
6e49e7126b57458968239a05b690486b
-
SHA1
c1a727548a4f5a55b02fdad630dd38adaa4f47a3
-
SHA256
935f82a18f59e081a15bc172c7a050aca35505aa9e5a7ffad8ecbe033c34b388
-
SHA512
903d23cb9faac4dd1181586cf1d8b36c73d7b4dc230cb3b726aff940d2b54eba8e27b40b713a140b7c3aa4d5c95b63c5e3df1bc79a740adb497f91920a1b08e3
-
SSDEEP
1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xo3/nyxa:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7j
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2380 hurok.exe -
Loads dropped DLL 1 IoCs
pid Process 1428 6e49e7126b5745_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1428 6e49e7126b5745_JC.exe 2380 hurok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1428 wrote to memory of 2380 1428 6e49e7126b5745_JC.exe 28 PID 1428 wrote to memory of 2380 1428 6e49e7126b5745_JC.exe 28 PID 1428 wrote to memory of 2380 1428 6e49e7126b5745_JC.exe 28 PID 1428 wrote to memory of 2380 1428 6e49e7126b5745_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e49e7126b5745_JC.exe"C:\Users\Admin\AppData\Local\Temp\6e49e7126b5745_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\hurok.exe"C:\Users\Admin\AppData\Local\Temp\hurok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2380
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5f494b62fc923c5354621ebb01a04fbc6
SHA1e8670dce438f96926f68c984571ebafd61ddaff1
SHA256d721da2ad664d0cb9c216ee1ae814d9e2ebce23b071a2e9ea547acb35e498f4c
SHA5128ace4664260e64967d7a88ae05ec17a3ce39c817f8285c03a74022176d20b37da6f55690a58d474a5375fc7ce2a07be181d085b34b3ac9b054a8c862e964c7c2
-
Filesize
63KB
MD5f494b62fc923c5354621ebb01a04fbc6
SHA1e8670dce438f96926f68c984571ebafd61ddaff1
SHA256d721da2ad664d0cb9c216ee1ae814d9e2ebce23b071a2e9ea547acb35e498f4c
SHA5128ace4664260e64967d7a88ae05ec17a3ce39c817f8285c03a74022176d20b37da6f55690a58d474a5375fc7ce2a07be181d085b34b3ac9b054a8c862e964c7c2
-
Filesize
63KB
MD5f494b62fc923c5354621ebb01a04fbc6
SHA1e8670dce438f96926f68c984571ebafd61ddaff1
SHA256d721da2ad664d0cb9c216ee1ae814d9e2ebce23b071a2e9ea547acb35e498f4c
SHA5128ace4664260e64967d7a88ae05ec17a3ce39c817f8285c03a74022176d20b37da6f55690a58d474a5375fc7ce2a07be181d085b34b3ac9b054a8c862e964c7c2