Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/07/2023, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
731cae0cdf0f99_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
731cae0cdf0f99_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
731cae0cdf0f99_JC.exe
-
Size
62KB
-
MD5
731cae0cdf0f991eb761bc70fe54214e
-
SHA1
d5eb00140a2d20e17a285d3651469a508d0b4a7a
-
SHA256
2e386bea909fa70b61b495012677ebff3293165fe575ecd8980dbfcc149c5250
-
SHA512
1672ed7bf20177c59b75ca79c6f128a46e7585380ae596f6dbaf775125e5da45441bd05411a3b58156db5b7714f763c92a57315885a0c98987b5828c189a6ce8
-
SSDEEP
1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1cKtbiM5:vCjsIOtEvwDpj5Hv0lG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2148 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2560 731cae0cdf0f99_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2148 2560 731cae0cdf0f99_JC.exe 28 PID 2560 wrote to memory of 2148 2560 731cae0cdf0f99_JC.exe 28 PID 2560 wrote to memory of 2148 2560 731cae0cdf0f99_JC.exe 28 PID 2560 wrote to memory of 2148 2560 731cae0cdf0f99_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\731cae0cdf0f99_JC.exe"C:\Users\Admin\AppData\Local\Temp\731cae0cdf0f99_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2148
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD504a7d9ef9729a30388b04271a3dff1f5
SHA1f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894
SHA256b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6
SHA5124b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020
-
Filesize
62KB
MD504a7d9ef9729a30388b04271a3dff1f5
SHA1f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894
SHA256b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6
SHA5124b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020
-
Filesize
62KB
MD504a7d9ef9729a30388b04271a3dff1f5
SHA1f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894
SHA256b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6
SHA5124b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020