Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
21/11/2023, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
Resource
win10v2004-20231023-en
General
-
Target
4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
-
Size
816KB
-
MD5
aac316903de887646b41713942062cd2
-
SHA1
3a9875685d6e4fa4a45352d3556c6cf8c3818fb5
-
SHA256
4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116
-
SHA512
8384334b1b9686c3a3d1fbc28f2f1ed6ebf41bec86fc5262bf4531db70304916a4d24e461a54eb17b6aa21cc41c4f1a5187d090d0a3d3b882cc745715ecf8b04
-
SSDEEP
24576:pY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9+:G3XZynV4oDabuWbDQOcIxJJ9+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1708 1B0C0D0C120F156C155C15E0E0A160A0E160A.exe -
Loads dropped DLL 2 IoCs
pid Process 1892 4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe 1892 4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1892 4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe 1708 1B0C0D0C120F156C155C15E0E0A160A0E160A.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1892 wrote to memory of 1708 1892 4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe 28 PID 1892 wrote to memory of 1708 1892 4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe 28 PID 1892 wrote to memory of 1708 1892 4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe 28 PID 1892 wrote to memory of 1708 1892 4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe"C:\Users\Admin\AppData\Local\Temp\4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exeC:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1708
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5f0da1442a179d4074cfb10acffa66631
SHA1e2fca5d7b810ad9086a23d3db7312112a202e6e9
SHA256ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535
SHA51218429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6
-
Filesize
816KB
MD5f0da1442a179d4074cfb10acffa66631
SHA1e2fca5d7b810ad9086a23d3db7312112a202e6e9
SHA256ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535
SHA51218429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6
-
Filesize
816KB
MD5f0da1442a179d4074cfb10acffa66631
SHA1e2fca5d7b810ad9086a23d3db7312112a202e6e9
SHA256ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535
SHA51218429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6
-
Filesize
816KB
MD5f0da1442a179d4074cfb10acffa66631
SHA1e2fca5d7b810ad9086a23d3db7312112a202e6e9
SHA256ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535
SHA51218429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6