Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe
Resource
win10v2004-20230703-en
General
-
Target
9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe
-
Size
11.3MB
-
MD5
254f08aba9a37e2bfac28f04f14b36c7
-
SHA1
b14f123541428e3a8053358fc7a5f15b5800d915
-
SHA256
9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92
-
SHA512
8068fe30417cea87b5b1dbacb81878b0a70f198ce4d29f6b75baf6141cbf08a80ba4b3ce259f73672241c8a1aeb970138b1be50c7a412600ebc88791245ebadc
-
SSDEEP
196608:fDL94UdVEy9qMBNLtlo0oog/QuO3x7Lmj/RBPkDqRSUshQW1suha0YsnfqWXqTKn:/94UdVEy9qMBNLtlo0oZYucxyrGFUavR
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2376 9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe 2376 9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Loaf\{323ADFF5-5A40-4fd7-8962-4F1034A21554}.tf 9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe"C:\Users\Admin\AppData\Local\Temp\9f527f93bfef3ee4e25be9e21c1d8587c5ac3980c492e52bcaa866887eb10f92.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD55c3382df7349dc2b42a2aae9a595779e
SHA12ab5a4369b6938a89008eccec8fa7595a6eda5e8
SHA256ca1e6b74d9448aa1b2daf7b843a4cc80a6fed13fe9480e0296ac8cadbae80d7e
SHA5125b9824552262e34bd50748529f3b8a053ef0faeda51a85735daa3521eeb28bbc1148de5e1508d7da3a6c8c8d4a31a355876872c46ed22250be1eb202bfcf1907
-
Filesize
1.9MB
MD5b434b1eff14158cb7708d70478b4f89a
SHA13e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb
SHA256e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708
SHA512303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75
-
Filesize
1.1MB
MD55c3382df7349dc2b42a2aae9a595779e
SHA12ab5a4369b6938a89008eccec8fa7595a6eda5e8
SHA256ca1e6b74d9448aa1b2daf7b843a4cc80a6fed13fe9480e0296ac8cadbae80d7e
SHA5125b9824552262e34bd50748529f3b8a053ef0faeda51a85735daa3521eeb28bbc1148de5e1508d7da3a6c8c8d4a31a355876872c46ed22250be1eb202bfcf1907