Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
11/11/2023, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe
Resource
win10v2004-20231020-en
General
-
Target
c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe
-
Size
1.5MB
-
MD5
d2f938a79fafc8b75db1387dcc9fe874
-
SHA1
0775bb51fec54adf4c42a87144ffd0beff2136ca
-
SHA256
c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52
-
SHA512
2e32d451c80deb584a593140e504918b60b568207d008156323ee2facdd0695e21ddc27057c766a7eae0774b207f029135329c2b860a214d18037aa7f41f5f2b
-
SSDEEP
24576:TLcl95uYLUhgkrCUZmnLkAltAIO9qKC1OB0iOCd1xMqbuWGYskjbL/5Ffd0:fctuYLEVCYmnLltdGJ0HCdfDGPUh
Malware Config
Signatures
-
Drops file in Drivers directory 4 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts kqubo.exe File opened for modification C:\Windows\System32\drivers\etc\hosts.ics kqubo.exe File created C:\Windows\System32\drivers\etc\hosts.ics kqubo.exe File opened for modification C:\Windows\System32\drivers\etc\hosts kqubo.exe -
Deletes itself 1 IoCs
pid Process 2304 kqubo.exe -
Executes dropped EXE 1 IoCs
pid Process 2304 kqubo.exe -
Loads dropped DLL 1 IoCs
pid Process 2196 c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2304 2196 c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe 29 PID 2196 wrote to memory of 2304 2196 c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe 29 PID 2196 wrote to memory of 2304 2196 c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe 29 PID 2196 wrote to memory of 2304 2196 c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe"C:\Users\Admin\AppData\Local\Temp\c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\kqubo.exe"C:\Users\Admin\AppData\Local\Temp\c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe"2⤵
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
PID:2304
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5d2f938a79fafc8b75db1387dcc9fe874
SHA10775bb51fec54adf4c42a87144ffd0beff2136ca
SHA256c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52
SHA5122e32d451c80deb584a593140e504918b60b568207d008156323ee2facdd0695e21ddc27057c766a7eae0774b207f029135329c2b860a214d18037aa7f41f5f2b
-
Filesize
1.5MB
MD5d2f938a79fafc8b75db1387dcc9fe874
SHA10775bb51fec54adf4c42a87144ffd0beff2136ca
SHA256c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52
SHA5122e32d451c80deb584a593140e504918b60b568207d008156323ee2facdd0695e21ddc27057c766a7eae0774b207f029135329c2b860a214d18037aa7f41f5f2b