Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
0afebef1662b7c98e35215b9f8c064eb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0afebef1662b7c98e35215b9f8c064eb.exe
Resource
win10v2004-20231215-en
General
-
Target
0afebef1662b7c98e35215b9f8c064eb.exe
-
Size
1.1MB
-
MD5
0afebef1662b7c98e35215b9f8c064eb
-
SHA1
0f7d13097edc10130dc1ec00ab8cedcd73cf02bb
-
SHA256
18e2becfddb9389884cfcd173b33d099adacf7fd069113c6c0da088a96868245
-
SHA512
0f854d309dcb5973fc68a902750af6aeccce2bc7e6eff17372fe156c4ca5e5ebe43f29eacbdd1ac86f68d3cba751d4aea5a060578d25cfcc3bb532a1eaddf259
-
SSDEEP
24576:SypW9SgLNZaOdcTMuUvxIg28VZLZaVCkeZTMnV8YwiU:St9SgLNZa6xIOVQCDTMnVjBU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1060 5947.tmp -
Executes dropped EXE 1 IoCs
pid Process 1060 5947.tmp -
Loads dropped DLL 1 IoCs
pid Process 2640 0afebef1662b7c98e35215b9f8c064eb.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2640 wrote to memory of 1060 2640 0afebef1662b7c98e35215b9f8c064eb.exe 28 PID 2640 wrote to memory of 1060 2640 0afebef1662b7c98e35215b9f8c064eb.exe 28 PID 2640 wrote to memory of 1060 2640 0afebef1662b7c98e35215b9f8c064eb.exe 28 PID 2640 wrote to memory of 1060 2640 0afebef1662b7c98e35215b9f8c064eb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0afebef1662b7c98e35215b9f8c064eb.exe"C:\Users\Admin\AppData\Local\Temp\0afebef1662b7c98e35215b9f8c064eb.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp" --pingC:\Users\Admin\AppData\Local\Temp\0afebef1662b7c98e35215b9f8c064eb.exe 070824C5A15C0EB936976D836DA663D415C5BDFEE63B09122D28B5F9313BF97DC94FF5F83FC5B4D348C6A4A56698ED0DB990259D7D8CED44BB685E0E88E35CC92⤵
- Deletes itself
- Executes dropped EXE
PID:1060
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
446KB
MD5894093cb121b75685a9253759fc8f419
SHA1ebe4b6f2dd7aceb35825f6a1019c2efc12f36fa4
SHA256bca80bdad39a7a90e7abec9081339df37dde8dbd6b1f37c673f0df64cfec9985
SHA512d644680c1fb4204157c8323658b20a5c38aa01142c7f9f91ef764e10535310e2d7252d9715cf5e57d55d799fd7e9a29bcca09c62f1ccc911ce2f2a7be7afcdbf
-
Filesize
975KB
MD50ca572bbeaa06339a73626487b5383e1
SHA1eb424f81c9f5c3096922506bbcb2854013a25fe2
SHA2561944d39a782179e19774f8a834f12e7ecf95b292addb1bd8bddf8073541034a7
SHA5123cf5ff7e61868321d66a88e9c55b0ae0103a2bd18b0c68e12e977fbdcdb9f12bac72a168974906112152cc5162903677f08f4cb0d5787f9d2dc0ef8e2ba29c9f