Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22/07/2023, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
NA_00332e553f21ffexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
NA_00332e553f21ffexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
NA_00332e553f21ffexe_JC.exe
-
Size
371KB
-
MD5
00332e553f21ff8a0724835c34427aa3
-
SHA1
bfd45c33dfffb77892212f143de6025d112ba327
-
SHA256
20b5bfa9aa4c6f893fcc43e332ca1a7c94c7ef9b12bdff214644ff07a2b120de
-
SHA512
e6eb6ebe29ef37c3a505a0dd6b932cc1e864d324daf9a3bcd9d312ff81d149f5fac10b35c75505ea230d55fa78bf1e6ea55f9691d1b58ac9534fa5dcd49f1a4e
-
SSDEEP
6144:oplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:oplrVbDdQaqdS/ofraFErH8uB2Wm0SXj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2252 Panel.exe -
Loads dropped DLL 2 IoCs
pid Process 1672 NA_00332e553f21ffexe_JC.exe 1672 NA_00332e553f21ffexe_JC.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\accordingly\Panel.exe NA_00332e553f21ffexe_JC.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1672 NA_00332e553f21ffexe_JC.exe 1672 NA_00332e553f21ffexe_JC.exe 1672 NA_00332e553f21ffexe_JC.exe 1672 NA_00332e553f21ffexe_JC.exe 2252 Panel.exe 2252 Panel.exe 2252 Panel.exe 2252 Panel.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2252 1672 NA_00332e553f21ffexe_JC.exe 28 PID 1672 wrote to memory of 2252 1672 NA_00332e553f21ffexe_JC.exe 28 PID 1672 wrote to memory of 2252 1672 NA_00332e553f21ffexe_JC.exe 28 PID 1672 wrote to memory of 2252 1672 NA_00332e553f21ffexe_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_00332e553f21ffexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_00332e553f21ffexe_JC.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\accordingly\Panel.exe"C:\Program Files\accordingly\Panel.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
371KB
MD543653158408e757a901dcd485f44469c
SHA1676bdf52198a78c87c7e1c0153325752fe4f4e91
SHA256b212368872cc9594e7dedbfdb5291d0c5aa787b084dc5390ccd925232aaee1f1
SHA51246b3401a62eb1e765010c12ee06b36e5f9c8a17b150a8baca96c54608ef0812de5dfdabe14a3a5da5228cbec3b2547c88e75cda9b384b0bcc36d43568976abab
-
Filesize
371KB
MD543653158408e757a901dcd485f44469c
SHA1676bdf52198a78c87c7e1c0153325752fe4f4e91
SHA256b212368872cc9594e7dedbfdb5291d0c5aa787b084dc5390ccd925232aaee1f1
SHA51246b3401a62eb1e765010c12ee06b36e5f9c8a17b150a8baca96c54608ef0812de5dfdabe14a3a5da5228cbec3b2547c88e75cda9b384b0bcc36d43568976abab
-
Filesize
371KB
MD543653158408e757a901dcd485f44469c
SHA1676bdf52198a78c87c7e1c0153325752fe4f4e91
SHA256b212368872cc9594e7dedbfdb5291d0c5aa787b084dc5390ccd925232aaee1f1
SHA51246b3401a62eb1e765010c12ee06b36e5f9c8a17b150a8baca96c54608ef0812de5dfdabe14a3a5da5228cbec3b2547c88e75cda9b384b0bcc36d43568976abab
-
Filesize
371KB
MD543653158408e757a901dcd485f44469c
SHA1676bdf52198a78c87c7e1c0153325752fe4f4e91
SHA256b212368872cc9594e7dedbfdb5291d0c5aa787b084dc5390ccd925232aaee1f1
SHA51246b3401a62eb1e765010c12ee06b36e5f9c8a17b150a8baca96c54608ef0812de5dfdabe14a3a5da5228cbec3b2547c88e75cda9b384b0bcc36d43568976abab