Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 20:57
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230915-en
General
-
Target
tmp.exe
-
Size
11.5MB
-
MD5
3832f42b8a1655a1ff2cce00aec7435b
-
SHA1
d3947a80f0c1aa1c7f743fcaa74b949ee35b1c83
-
SHA256
87fb26371ed0229ba3706a76b11520bfe751a443e6598fa39d2a382facfb67eb
-
SHA512
f26048366df42d3978422a8b02c99b9b43610cf0e3e9b449c1a5280af7b4319feb9f20c7852698783bdc3ed6156b066a1cfd359d4caff46d44548277e0b473bb
-
SSDEEP
196608:9Wpurk8eVGB94/PByD/pUwjD7Qy9L4EfOaKONEagH+Y5afzyiyenR+hhcZl:TIVLXMrpJ8y9Lr2XnH+YAOi9+hGb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2772 loadder.exe -
Loads dropped DLL 2 IoCs
pid Process 2976 tmp.exe 2772 loadder.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2772 2976 tmp.exe 29 PID 2976 wrote to memory of 2772 2976 tmp.exe 29 PID 2976 wrote to memory of 2772 2976 tmp.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\onefile_2976_133414476290304000\loadder.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.3MB
MD587cca57fb4e1e11e5662a70f7eb4354f
SHA1e15cc5f747bff5b209fdbcff3aefd204155308f3
SHA2563f4c039beaa990f95e1aac8fcc9cc366a69139189a95eaeafa12d78c73be5bab
SHA51252a14d3aa63f409b770510d822ca04528ee163507787ec46cfb48a1dfc76da13a3013348232302eac1d4011197386e960b04db761aa7520f29a62be0b3fb7c81
-
Filesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
-
Filesize
21.3MB
MD587cca57fb4e1e11e5662a70f7eb4354f
SHA1e15cc5f747bff5b209fdbcff3aefd204155308f3
SHA2563f4c039beaa990f95e1aac8fcc9cc366a69139189a95eaeafa12d78c73be5bab
SHA51252a14d3aa63f409b770510d822ca04528ee163507787ec46cfb48a1dfc76da13a3013348232302eac1d4011197386e960b04db761aa7520f29a62be0b3fb7c81
-
Filesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858