Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31/08/2023, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
Resource
win10v2004-20230703-en
General
-
Target
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
-
Size
1.2MB
-
MD5
9c867cfa11ef97ff46e3a56fb34af73d
-
SHA1
b7559650173c346f72de9a8bf4c0eb21a7802c39
-
SHA256
0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1
-
SHA512
a52343e53265c9239b6e6ad91abee77a602995e243d5b52576a6a8d0114af7976c31802a8ce7ac6fb9870da4ace2fc1ac5544667031dc2d44f2619d0e3072610
-
SSDEEP
24576:gpGHEHpX0oxQjUo123oqb7XF0tPrBjH9/Idy/G3i/nh:gnXtxo1FkGZVztIy5nh
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2144-1-0x0000000010000000-0x0000000010017000-memory.dmp upx behavioral1/memory/2144-9-0x0000000010000000-0x0000000010017000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\S: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\T: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\B: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\I: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\J: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\K: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\Q: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\U: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\Z: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\E: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\H: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\M: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\N: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\X: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\G: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\V: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\Y: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\A: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\L: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\O: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\P: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe File opened (read-only) \??\W: 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2144 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2144 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe 2144 0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe"C:\Users\Admin\AppData\Local\Temp\0b3070e2f3328aaf57f001be7244e787b58b5a3c978282dde1c14aaacab783d1.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51B
MD5d4b764f603e826edd5ba0d5c09f95390
SHA1fab2158dc4fdf2cd3eae3e666a56f79234c8e2f8
SHA256fc0aba460f046d6141230f39047577b6d785e71b116a99023ecb39a350bb3192
SHA512d52046e23ad436f75edbe1c9838aaeb96ed6bad252c7ee74796ee744caabd6aac2f74ac2e6490b499753846e45295f427b33ba5a878fcf5534eb07b98f1173df