Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/08/2023, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe
Resource
win10v2004-20230703-en
General
-
Target
27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe
-
Size
2.3MB
-
MD5
be6d8f3b8b9132969ccd36171815cf9c
-
SHA1
25569a885b5af220d8e328ffb3f1d18f957d7da3
-
SHA256
27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447
-
SHA512
b350f1c400a35c23bb3a2a1d04b778f879fbea235fea10b96f5748b2698c6ca26e390765bc0145d885e017df7f7f92c28d9ae91ec691c5e51bf2a17338678ec3
-
SSDEEP
49152:cxefzHKtM0LBvIYkoECOd7a8Fd++r5u8QeI:yeKtnLBvILDCOJdpKL
Malware Config
Signatures
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 2012 27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe 2012 27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2012 27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2012 27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe"C:\Users\Admin\AppData\Local\Temp\27cf6dab51d7f9e08431e6c5fa9376dbd9435c88f9e27a7aa72127e270d4c447.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2012
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51f4c13055a5b8e875ff5f38cd47d7328
SHA18c5e6c136f275b1db28964b70f41a4c92758c09c
SHA25647a26512bde3cb846dd9ec782c1d1f129dc5546ed9ac2d22d523e4ed3d5fbd0a
SHA512c715634d806c96b0e1e395e28a0049e8b04e4a109c83b486fb1abced02e9c316da375e935625ed499337f0493ad9b7d2a75db79a367a238ff49db9ef6513ddbc
-
Filesize
6KB
MD554588febfaf64b3e183da823b7e768f8
SHA188c09f674c24f5dc1f5b6ce948de161c89c9ee62
SHA256224e8d23211fc02506c0eb3c2e6a99bed10d98a833caf006badcbc497c481dfa
SHA5129975682d45c80ac66df254cfe0a326ccb9c2aebd3f3804c1f1f046fa447236337c8597e484b2b15b51bbe219ae37375b14f1848d8f69c66c4b9818548d6901eb
-
Filesize
1KB
MD51f4c13055a5b8e875ff5f38cd47d7328
SHA18c5e6c136f275b1db28964b70f41a4c92758c09c
SHA25647a26512bde3cb846dd9ec782c1d1f129dc5546ed9ac2d22d523e4ed3d5fbd0a
SHA512c715634d806c96b0e1e395e28a0049e8b04e4a109c83b486fb1abced02e9c316da375e935625ed499337f0493ad9b7d2a75db79a367a238ff49db9ef6513ddbc
-
Filesize
38B
MD5dad9f855dc6f3ce354b7bf53cee43dce
SHA15f7ad9767715d63587a5c8d4bf6a6600345bc771
SHA256ea52deb7095fd8ac2cd732e8b4771fe8401db44792dd02d6e45d10b50dd5cd90
SHA51220e29978989a653ce80851f082ca72b7989ae2e318be3d2709bde56cbf67a6fca71b78d769172a14bf7e23ac7a7ab28ffe4d0cbb1319cadfbb6bf0d8c431b762
-
Filesize
129.8MB
MD551a534ddfddb68c31a1ba04aa86d5e6d
SHA125a12cdb763d5cde3d7cfc2717c84a9c9e99c130
SHA256c54ee5e9df39d78f2cd3fd6881e420e6d56c317b1aabf869686c6c40f9981b71
SHA5121f206ad90ed780f65431068da1287dd2201fc5610bda669d3eaaecae48a85d1abd995ca32a6178c7ae1190c552c1eb328f44e0c0fe9cec4099f6f2fcf69b5548
-
Filesize
129.8MB
MD551a534ddfddb68c31a1ba04aa86d5e6d
SHA125a12cdb763d5cde3d7cfc2717c84a9c9e99c130
SHA256c54ee5e9df39d78f2cd3fd6881e420e6d56c317b1aabf869686c6c40f9981b71
SHA5121f206ad90ed780f65431068da1287dd2201fc5610bda669d3eaaecae48a85d1abd995ca32a6178c7ae1190c552c1eb328f44e0c0fe9cec4099f6f2fcf69b5548