Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/07/2023, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
965add07cbdaf3_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
965add07cbdaf3_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
965add07cbdaf3_JC.exe
-
Size
53KB
-
MD5
965add07cbdaf379686bd9830d197586
-
SHA1
d22fd17355d080a0e33e70185800fcf9662e64ee
-
SHA256
3d0a54bb97e0180dce9947718a7069ed2e86eebe1609b9957f76802f730957ea
-
SHA512
2e18bfe3114489794d980942cea82dc89ccd264264d9f1496849421d0064c3ad53c1dc1b2abb11693f78953f34d7176b98136eabbe7cf1eb84a720d449b8aadd
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I5Ia:6j+1NMOtEvwDpjr8ox8P
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2116 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2632 965add07cbdaf3_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2116 2632 965add07cbdaf3_JC.exe 28 PID 2632 wrote to memory of 2116 2632 965add07cbdaf3_JC.exe 28 PID 2632 wrote to memory of 2116 2632 965add07cbdaf3_JC.exe 28 PID 2632 wrote to memory of 2116 2632 965add07cbdaf3_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\965add07cbdaf3_JC.exe"C:\Users\Admin\AppData\Local\Temp\965add07cbdaf3_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2116
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD523fb138213ffd341b7d8e461a8c5f96a
SHA13b9cbbb8f4f0f104db24555fe5bc0fe39157561e
SHA256961bf602b89af5425622a7baeda0e6b6733f95185a4dd0b45762e2eed5e8c402
SHA512827d65fc55fad46df0c84445e637720f2f4737675342efe95c2913739347559e61f63859d18f1ccc93010754af55d97f20ae680d729312fd76dc94d91daa47e2
-
Filesize
53KB
MD523fb138213ffd341b7d8e461a8c5f96a
SHA13b9cbbb8f4f0f104db24555fe5bc0fe39157561e
SHA256961bf602b89af5425622a7baeda0e6b6733f95185a4dd0b45762e2eed5e8c402
SHA512827d65fc55fad46df0c84445e637720f2f4737675342efe95c2913739347559e61f63859d18f1ccc93010754af55d97f20ae680d729312fd76dc94d91daa47e2
-
Filesize
53KB
MD523fb138213ffd341b7d8e461a8c5f96a
SHA13b9cbbb8f4f0f104db24555fe5bc0fe39157561e
SHA256961bf602b89af5425622a7baeda0e6b6733f95185a4dd0b45762e2eed5e8c402
SHA512827d65fc55fad46df0c84445e637720f2f4737675342efe95c2913739347559e61f63859d18f1ccc93010754af55d97f20ae680d729312fd76dc94d91daa47e2