Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 02:16
Behavioral task
behavioral1
Sample
78c314626e276394.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
78c314626e276394.exe
Resource
win10v2004-20231215-en
General
-
Target
78c314626e276394.exe
-
Size
13.9MB
-
MD5
ce37734939793a008c70e01b6297f9ff
-
SHA1
7250d740e1f81977f0083cd24f6bf1279c2366ad
-
SHA256
12307e4fea0989f0c60e3501549d8c9d1ee2842d3980f3bd29ded12325b23d4c
-
SHA512
8c89987ee075b6d0717971a0f6beb678e878c82c546b2cae31abdeca5948c4ab4a54cb4104071d3c7376661b890085dd1babdecf4e691c5af4c0a68fdad2732b
-
SSDEEP
196608:9i/lOqPnih8FXj+hYeB0sKYu/PaQgKDnO8NpHzgsAGKaRZtG7STKKVtqlKFwY0nT:/qPnLFCjQpDOETgsv/G+TH6KF01ck
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2616 78c314626e276394.exe -
resource yara_rule behavioral1/files/0x0005000000019790-95.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2616 2416 78c314626e276394.exe 28 PID 2416 wrote to memory of 2616 2416 78c314626e276394.exe 28 PID 2416 wrote to memory of 2616 2416 78c314626e276394.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\78c314626e276394.exe"C:\Users\Admin\AppData\Local\Temp\78c314626e276394.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\78c314626e276394.exe"C:\Users\Admin\AppData\Local\Temp\78c314626e276394.exe"2⤵
- Loads dropped DLL
PID:2616
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378