Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/07/2023, 18:37
Static task
static1
Behavioral task
behavioral1
Sample
a504db401316cf_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a504db401316cf_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
a504db401316cf_JC.exe
-
Size
58KB
-
MD5
a504db401316cf27f741ffeafa8fdb4d
-
SHA1
988f118a76ded31141956b9e8494ac96284bbaa9
-
SHA256
7b94cf4f377ba1d7fcbeacc685939acee785cfaec4368b878adbdce7c078f005
-
SHA512
816c73c2eea43c98f867c8fda413b318fb92afb62472c6f21dad5629004a7c330f6c276a81ebbc4b20dde5d0aa86d5056dfefcabe4e734e570451e8c43e84777
-
SSDEEP
1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1kMw:vCjsIOtEvwDpj5Hv09
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1984 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2248 a504db401316cf_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1984 2248 a504db401316cf_JC.exe 28 PID 2248 wrote to memory of 1984 2248 a504db401316cf_JC.exe 28 PID 2248 wrote to memory of 1984 2248 a504db401316cf_JC.exe 28 PID 2248 wrote to memory of 1984 2248 a504db401316cf_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a504db401316cf_JC.exe"C:\Users\Admin\AppData\Local\Temp\a504db401316cf_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:1984
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5971d07e05d32c8f83634e366d323f77d
SHA159cfb67384668f334b7a41471626cc308bd230e2
SHA2561766976e1fdc743d5db43b26c2e79cc1532efc729466097cef4e01fffbfa69b0
SHA5126806526f2251e3297295bd56c97b1be0de71abc6602f790fb95ce0db3e6395b515cf4f03f0f8b00eabe1777f5baa8a7dca39e4f5553a404c7f1282aa71025150
-
Filesize
58KB
MD5971d07e05d32c8f83634e366d323f77d
SHA159cfb67384668f334b7a41471626cc308bd230e2
SHA2561766976e1fdc743d5db43b26c2e79cc1532efc729466097cef4e01fffbfa69b0
SHA5126806526f2251e3297295bd56c97b1be0de71abc6602f790fb95ce0db3e6395b515cf4f03f0f8b00eabe1777f5baa8a7dca39e4f5553a404c7f1282aa71025150
-
Filesize
58KB
MD5971d07e05d32c8f83634e366d323f77d
SHA159cfb67384668f334b7a41471626cc308bd230e2
SHA2561766976e1fdc743d5db43b26c2e79cc1532efc729466097cef4e01fffbfa69b0
SHA5126806526f2251e3297295bd56c97b1be0de71abc6602f790fb95ce0db3e6395b515cf4f03f0f8b00eabe1777f5baa8a7dca39e4f5553a404c7f1282aa71025150