Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe
Resource
win10v2004-20230915-en
General
-
Target
78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe
-
Size
1.6MB
-
MD5
5ef602e9059c1bb09594b28dcdc164e4
-
SHA1
aa7d5f68fcf83c4e06237e8fadde070c660292e4
-
SHA256
78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2
-
SHA512
b64a6b069a1ce2e6295541160ed6264f25580d196bc86c055c2e2a1550833d74f118e23badc0226130841d153ed57102b7cb6a21a16300a82dd9ac1147ead386
-
SSDEEP
49152:CvxfXTMRuwHOWKw7kTtCTdxH/eSTdjYhCyU:CvxwRuw9Kw7k8Td9eSJYhCyU
Malware Config
Signatures
-
Loads dropped DLL 8 IoCs
pid Process 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 740 wrote to memory of 1840 740 78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe 30 PID 740 wrote to memory of 1840 740 78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe 30 PID 740 wrote to memory of 1840 740 78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe 30 PID 740 wrote to memory of 1840 740 78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe 30 PID 1840 wrote to memory of 1612 1840 control.exe 31 PID 1840 wrote to memory of 1612 1840 control.exe 31 PID 1840 wrote to memory of 1612 1840 control.exe 31 PID 1840 wrote to memory of 1612 1840 control.exe 31 PID 1840 wrote to memory of 1612 1840 control.exe 31 PID 1840 wrote to memory of 1612 1840 control.exe 31 PID 1840 wrote to memory of 1612 1840 control.exe 31 PID 1612 wrote to memory of 2680 1612 rundll32.exe 32 PID 1612 wrote to memory of 2680 1612 rundll32.exe 32 PID 1612 wrote to memory of 2680 1612 rundll32.exe 32 PID 1612 wrote to memory of 2680 1612 rundll32.exe 32 PID 2680 wrote to memory of 2684 2680 RunDll32.exe 33 PID 2680 wrote to memory of 2684 2680 RunDll32.exe 33 PID 2680 wrote to memory of 2684 2680 RunDll32.exe 33 PID 2680 wrote to memory of 2684 2680 RunDll32.exe 33 PID 2680 wrote to memory of 2684 2680 RunDll32.exe 33 PID 2680 wrote to memory of 2684 2680 RunDll32.exe 33 PID 2680 wrote to memory of 2684 2680 RunDll32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe"C:\Users\Admin\AppData\Local\Temp\78ec3feb915e6426b1e0ac39d36429274e1a43601ac8e88ab5c0a9fa64fdffd2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",2⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",4⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\8EZ1I.CpL",5⤵
- Loads dropped DLL
PID:2684
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb
-
Filesize
1.4MB
MD5b98f29b60d2677d00e5707b844f6b298
SHA1dce9c97e53cb59cec3f6f628d933d4be24f3c707
SHA256aafad4410aaf5931ab4eda2a6095c099ba9ccc909debc859f31f6bd515ad3d35
SHA51248498ee5800783ac0d2dde151813c5afe2411944490e683c40d8040442468a554ce651b8ac8b663f9fcfd2ca153fb174dcdef5f6b80c7f8f1813f9dd8730cbcb