Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/12/2023, 02:43
Behavioral task
behavioral1
Sample
810f68eeb94b8ef7c3a886c64fb6f401.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
810f68eeb94b8ef7c3a886c64fb6f401.exe
Resource
win10v2004-20231215-en
General
-
Target
810f68eeb94b8ef7c3a886c64fb6f401.exe
-
Size
17.7MB
-
MD5
810f68eeb94b8ef7c3a886c64fb6f401
-
SHA1
bda874b438cd9c626e16dae630a2d0609abdb55c
-
SHA256
7a3976c1bbdc51830e609198105dcff71251e017e2043c0136eb2b49055308a7
-
SHA512
df00d0abaa425cb5920fd49d218e620f1665a05b41164a0cf5558ca3b491a2f0ca2450de25094dfc4889b974bc44de0c6f30f10dd9daffb3f0877c927cc71889
-
SSDEEP
393216:jqPnLFXlrVgQpDOETgsvfGFw9gm5RzvEoytDLBq:mPLFXN6QoEJhkz3U
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 528 810f68eeb94b8ef7c3a886c64fb6f401.exe -
resource yara_rule behavioral1/files/0x00050000000197f0-111.dat upx behavioral1/memory/528-113-0x000007FEF6760000-0x000007FEF6BCE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1308 wrote to memory of 528 1308 810f68eeb94b8ef7c3a886c64fb6f401.exe 28 PID 1308 wrote to memory of 528 1308 810f68eeb94b8ef7c3a886c64fb6f401.exe 28 PID 1308 wrote to memory of 528 1308 810f68eeb94b8ef7c3a886c64fb6f401.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\810f68eeb94b8ef7c3a886c64fb6f401.exe"C:\Users\Admin\AppData\Local\Temp\810f68eeb94b8ef7c3a886c64fb6f401.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\810f68eeb94b8ef7c3a886c64fb6f401.exe"C:\Users\Admin\AppData\Local\Temp\810f68eeb94b8ef7c3a886c64fb6f401.exe"2⤵
- Loads dropped DLL
PID:528
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378