Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
22/10/2023, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe
Resource
win10v2004-20231020-en
General
-
Target
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe
-
Size
345KB
-
MD5
1860ebf427dccac7292813bb1fa12e5b
-
SHA1
d889765ae93d9543ac9725345ab3814490d176a7
-
SHA256
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37
-
SHA512
ed2a155d6128b7c8c958c89e823f3ec7c95ac5770f4bd8731ebcbeb70fa3a8df42a9cf54dec1121a07185766f759ed08b404840fee36c32d320de18acf70db6b
-
SSDEEP
6144:aMGZ2bjyNNGhGwfAe90daIOT7DGDdJtLYL:RUwjyNoGwxMaJQ7E
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2488 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2560 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2560 taskkill.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2580 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 28 PID 1720 wrote to memory of 2580 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 28 PID 1720 wrote to memory of 2580 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 28 PID 1720 wrote to memory of 2580 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 28 PID 1720 wrote to memory of 2984 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 30 PID 1720 wrote to memory of 2984 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 30 PID 1720 wrote to memory of 2984 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 30 PID 1720 wrote to memory of 2984 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 30 PID 1720 wrote to memory of 2704 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 32 PID 1720 wrote to memory of 2704 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 32 PID 1720 wrote to memory of 2704 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 32 PID 1720 wrote to memory of 2704 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 32 PID 1720 wrote to memory of 2688 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 34 PID 1720 wrote to memory of 2688 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 34 PID 1720 wrote to memory of 2688 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 34 PID 1720 wrote to memory of 2688 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 34 PID 1720 wrote to memory of 2488 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 37 PID 1720 wrote to memory of 2488 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 37 PID 1720 wrote to memory of 2488 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 37 PID 1720 wrote to memory of 2488 1720 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 37 PID 2488 wrote to memory of 2560 2488 cmd.exe 39 PID 2488 wrote to memory of 2560 2488 cmd.exe 39 PID 2488 wrote to memory of 2560 2488 cmd.exe 39 PID 2488 wrote to memory of 2560 2488 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe"C:\Users\Admin\AppData\Local\Temp\87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\9647193940.exe"2⤵PID:2580
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1825922184.exe"2⤵PID:2984
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6538659037.exe"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\3498418755.exe"2⤵PID:2688
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31B
MD514bd4840f258f302f7e5e26f7760d756
SHA1fea8b87644d13e0007c75c6a33b981e4a544f0d3
SHA2568826bedef4ca1423979859bbfa57c882780d4e59394bd4dabcf1ae878aa8373e
SHA512b2016191add2ffc492a32a8c0c42ecb87f7494a909dabf5cc4fd01b857310e4583ec00a98c6fe2720791db2a51919086eec4d35c39c2d24f92279acfb3cf9cb6