Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
08/08/2023, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
DRAWING-MATERIALS NEEDED.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
DRAWING-MATERIALS NEEDED.exe
Resource
win10v2004-20230703-en
General
-
Target
DRAWING-MATERIALS NEEDED.exe
-
Size
273KB
-
MD5
6ea128aad981db51fb37a219cb6b266e
-
SHA1
37bdacba8fe247ff5ead7524a0ffc17b7dfbfdbc
-
SHA256
63c7c7144d487bb38e9473ed1a7b420440b131981c5e83901614212f7d9bd8d8
-
SHA512
dfd285c8fb0026025a1c60c46efd0c02d9cd5741e04219c5cb1aaeba9f08e0c3f42735f5f6d1bb61294cef203aa3e6caa60fec879b4b6940f6641e0b6c42bac3
-
SSDEEP
6144:YzAJFXG1/PZthjld/77Pm3pHT5EzjDu7w5x:CCar377ypz5ELu7w5x
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe DRAWING-MATERIALS NEEDED.exe -
Loads dropped DLL 1 IoCs
pid Process 1648 DRAWING-MATERIALS NEEDED.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1648 DRAWING-MATERIALS NEEDED.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2972 1648 WerFault.exe 9 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2972 1648 DRAWING-MATERIALS NEEDED.exe 28 PID 1648 wrote to memory of 2972 1648 DRAWING-MATERIALS NEEDED.exe 28 PID 1648 wrote to memory of 2972 1648 DRAWING-MATERIALS NEEDED.exe 28 PID 1648 wrote to memory of 2972 1648 DRAWING-MATERIALS NEEDED.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\DRAWING-MATERIALS NEEDED.exe"C:\Users\Admin\AppData\Local\Temp\DRAWING-MATERIALS NEEDED.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 4922⤵
- Program crash
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD54d3b19a81bd51f8ce44b93643a4e3a99
SHA135f8b00e85577b014080df98bd2c378351d9b3e9
SHA256fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
SHA512b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622