Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
10/08/2023, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe
Resource
win10v2004-20230703-en
General
-
Target
efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe
-
Size
5.8MB
-
MD5
9b499068571b91be9372076eb2a4bc44
-
SHA1
aaddf7295ca92283badfec40f0194ea2eb7df964
-
SHA256
efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40
-
SHA512
0348b9b14c50b5404cb8d0c2573059e31132dfcbb83efe2a991fc9db3fb0e423775d9528d816ac4a44678209a9e1551f36b3c920affe5bc2171726c88e83a392
-
SSDEEP
98304:AqVQ4tml/iUm4XHb8vFtYkQvrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:/J+jX7oDIrSpru+W3KMZkvdagNXhJs0I
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
resource yara_rule behavioral1/memory/2192-8762-0x0000000000400000-0x000000000051F000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 2 IoCs
pid Process 2192 GameLoadep.exe 652 Terms.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe 2192 GameLoadep.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Terms.exe GameLoadep.exe File opened for modification C:\Program Files (x86)\Terms.exe GameLoadep.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\GameLoadep.exe efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2192 GameLoadep.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1504 efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1504 efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe 1504 efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 2192 1504 efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe 30 PID 1504 wrote to memory of 2192 1504 efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe 30 PID 1504 wrote to memory of 2192 1504 efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe 30 PID 1504 wrote to memory of 2192 1504 efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe"C:\Users\Admin\AppData\Local\Temp\efacd8ae556cc35d412c45f19e37f3feb4b3fd10bcedbd71b2b47b47dd58ae40.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\GameLoadep.exeC:\Windows\GameLoadep.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
-
C:\Program Files (x86)\Terms.exe"C:\Program Files (x86)\Terms.exe"1⤵
- Executes dropped EXE
PID:652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
864KB
MD5645a7e5dc4adc68141447b01cb9cec49
SHA12f83beeb3031aa238c8eba4ae04398ff38274780
SHA25676931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17
SHA512fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de
-
Filesize
864KB
MD5645a7e5dc4adc68141447b01cb9cec49
SHA12f83beeb3031aa238c8eba4ae04398ff38274780
SHA25676931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17
SHA512fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de
-
Filesize
864KB
MD5645a7e5dc4adc68141447b01cb9cec49
SHA12f83beeb3031aa238c8eba4ae04398ff38274780
SHA25676931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17
SHA512fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de
-
Filesize
864KB
MD5645a7e5dc4adc68141447b01cb9cec49
SHA12f83beeb3031aa238c8eba4ae04398ff38274780
SHA25676931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17
SHA512fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de