Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
1663559ece1711b3977fe1992af8e7bd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1663559ece1711b3977fe1992af8e7bd.exe
Resource
win10v2004-20231201-en
General
-
Target
1663559ece1711b3977fe1992af8e7bd.exe
-
Size
1.9MB
-
MD5
1663559ece1711b3977fe1992af8e7bd
-
SHA1
794f965dbc0dcff47d9169cb684a129111caaed2
-
SHA256
fe6738ac4768a2b35e355389470c0e0f793fbf48ebb824241d51ba3e7c3a4be4
-
SHA512
21dbb1011737a531155d6b04401eb72a5b54f308e0852cb864a8e05af853c91b4154874c69fc81b469f290246fa57b145653f1d89fa645ba4e22e65391f829a6
-
SSDEEP
49152:Qoa1taC070dFKbRzfK9owiV4zMBppBsoY0:Qoa1taC0eKb8owDIppBVr
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2144 1796.tmp -
Executes dropped EXE 1 IoCs
pid Process 2144 1796.tmp -
Loads dropped DLL 1 IoCs
pid Process 2360 1663559ece1711b3977fe1992af8e7bd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2144 2360 1663559ece1711b3977fe1992af8e7bd.exe 28 PID 2360 wrote to memory of 2144 2360 1663559ece1711b3977fe1992af8e7bd.exe 28 PID 2360 wrote to memory of 2144 2360 1663559ece1711b3977fe1992af8e7bd.exe 28 PID 2360 wrote to memory of 2144 2360 1663559ece1711b3977fe1992af8e7bd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1663559ece1711b3977fe1992af8e7bd.exe"C:\Users\Admin\AppData\Local\Temp\1663559ece1711b3977fe1992af8e7bd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1663559ece1711b3977fe1992af8e7bd.exe D3106D90A36ACCCBBC1CE41859D93BDC693EFDD349442FC84D073530A017C9B90960BD6009DA3DCFA0DD0FF98A08683D971A696735B9FE0965FE0E46834C724D2⤵
- Deletes itself
- Executes dropped EXE
PID:2144
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5932b898756e54cda37ee11782d074407
SHA1f944a431d2bd56f7165df4cb03b95af51b299302
SHA25652b3fab090060ee93280be4a36905dcc13e0257d5ee2cb50c6f05faac7697aa9
SHA512765240431e1b8ad0d6bfe60a64b404d59db390cdb213f28c8c50dff7871bd7f11bf7111f6f00ce243dbe82abb7681101cb6ca117044cdf41f726a2f90cf4448f