Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29/08/2023, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe
Resource
win7-20230712-en
General
-
Target
c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe
-
Size
1.2MB
-
MD5
7c51dc5d71be90a5c87cdc71bc724291
-
SHA1
69c20adb256634e021b18870f16b4823051468f6
-
SHA256
c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549
-
SHA512
7caa9c3beb2adffcc9cc4911ead787c3cb21b1b5909d03866cc64a24c3d6ff5df7a91cd5e1f9f4abd7becf23ffda5fd7fec3e800bde0815499cee15fb1428b4f
-
SSDEEP
24576:9kF4MQb/sZnXRb7cFsC2nwHCcUzhzxRvL:9Bsb7cF8uCcGljL
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/2684-2-0x0000000010000000-0x0000000010024000-memory.dmp family_blackmoon behavioral1/memory/2684-15-0x0000000010000000-0x0000000010024000-memory.dmp family_blackmoon -
Loads dropped DLL 1 IoCs
pid Process 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe -
resource yara_rule behavioral1/memory/2684-1-0x0000000000250000-0x000000000025B000-memory.dmp upx behavioral1/memory/2684-2-0x0000000010000000-0x0000000010024000-memory.dmp upx behavioral1/memory/2684-3-0x0000000010000000-0x0000000010024000-memory.dmp upx behavioral1/memory/2684-14-0x0000000000250000-0x000000000025B000-memory.dmp upx behavioral1/memory/2684-15-0x0000000010000000-0x0000000010024000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2684 wrote to memory of 1916 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe 28 PID 2684 wrote to memory of 1916 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe 28 PID 2684 wrote to memory of 1916 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe 28 PID 2684 wrote to memory of 1916 2684 c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe 28 PID 1916 wrote to memory of 2472 1916 cmd.exe 30 PID 1916 wrote to memory of 2472 1916 cmd.exe 30 PID 1916 wrote to memory of 2472 1916 cmd.exe 30 PID 1916 wrote to memory of 2472 1916 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe"C:\Users\Admin\AppData\Local\Temp\c8138df0c5685172086a1c218759a1b1885e6145c0e31b77c510e30bc38d2549.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd.exe /c route print -42⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\ROUTE.EXEroute print -43⤵PID:2472
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5678554e4ee9fe69d09ea1d1f93944bdc
SHA1a74694add4e98c8e47b85d4d398ca28eff486225
SHA256d6a56ce2364729210764cc90b8b7e0347c6ff722a2481ea190dd68a6c49dfa56
SHA51209b5e43717cc4a1956e994100473aac116e59e9229a6e9670cadf795185a27e5d7dba84192d1991f325959fc7371460eded76a6bf1512e71afb17a8439a79871