Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/07/2023, 15:46
Static task
static1
Behavioral task
behavioral1
Sample
c2e78361568544_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c2e78361568544_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
c2e78361568544_JC.exe
-
Size
35KB
-
MD5
c2e783615685445e58944bf183ffa6a6
-
SHA1
76c7d5773e8c20171469357aedf4d4a179a9b774
-
SHA256
b86826c30b867d1c18cbcfd7ac19fcf401b2ec36eea641b98aaf0156706ab133
-
SHA512
0e69cb8c1260fbaadd137159c7043adf41dd171fc009050646548de925970cf99f643fc69da03d242e90738ce0bb8b182101719516cc500be6c8d6542b47a95d
-
SSDEEP
384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+0vJsg5b5Usr:bgX4zYcgTEu6QOaryfjqDlC6JFbK4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1748 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 2400 c2e78361568544_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 1748 2400 c2e78361568544_JC.exe 28 PID 2400 wrote to memory of 1748 2400 c2e78361568544_JC.exe 28 PID 2400 wrote to memory of 1748 2400 c2e78361568544_JC.exe 28 PID 2400 wrote to memory of 1748 2400 c2e78361568544_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2e78361568544_JC.exe"C:\Users\Admin\AppData\Local\Temp\c2e78361568544_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:1748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5a307cc07af13370bd4f34fb95bb8931a
SHA1184d11b2b033bb1a84a46e01111bd361b0590431
SHA256b42f51ff91bb676afa3bbae36ef9395067a21999bfe69c37ccbca4ed852cd049
SHA512ccd0b24ade17ef7726276a35d4c89f135f0edca35e30acc5ae769d02656c387c55fd4690941d070832d8f4548e27e5264d5b0eba47a6d6c6c336eebda40d4475
-
Filesize
35KB
MD5a307cc07af13370bd4f34fb95bb8931a
SHA1184d11b2b033bb1a84a46e01111bd361b0590431
SHA256b42f51ff91bb676afa3bbae36ef9395067a21999bfe69c37ccbca4ed852cd049
SHA512ccd0b24ade17ef7726276a35d4c89f135f0edca35e30acc5ae769d02656c387c55fd4690941d070832d8f4548e27e5264d5b0eba47a6d6c6c336eebda40d4475
-
Filesize
35KB
MD5a307cc07af13370bd4f34fb95bb8931a
SHA1184d11b2b033bb1a84a46e01111bd361b0590431
SHA256b42f51ff91bb676afa3bbae36ef9395067a21999bfe69c37ccbca4ed852cd049
SHA512ccd0b24ade17ef7726276a35d4c89f135f0edca35e30acc5ae769d02656c387c55fd4690941d070832d8f4548e27e5264d5b0eba47a6d6c6c336eebda40d4475