Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 02:53
Static task
static1
Behavioral task
behavioral1
Sample
56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
Resource
win10v2004-20231215-en
General
-
Target
56f34b3ab700e04ec7c3e8c7bc78dd3d.exe
-
Size
987KB
-
MD5
56f34b3ab700e04ec7c3e8c7bc78dd3d
-
SHA1
fc45745fe582d9229354855686bb05156b1d4bba
-
SHA256
725b6df7934f8e1f7503766960a763653f02209d135b3728f89f243dcbf9ccbf
-
SHA512
1118f937bcbeece8f6eb738af6331c3eea37736b40061f7e64198ea0781ba4e939b91ebff8083d578b4575e93707cd70c9659ca7ae592830902f66e0e17c58b0
-
SSDEEP
24576:dgdhhQGGniba/WPpuvlBEaneHueYQFSMVNS/:dqj5s8+elYQFSM7u
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1796 vpb.exe -
Loads dropped DLL 1 IoCs
pid Process 1948 56f34b3ab700e04ec7c3e8c7bc78dd3d.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\utsiawm\vpb.exe 56f34b3ab700e04ec7c3e8c7bc78dd3d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1796 1948 56f34b3ab700e04ec7c3e8c7bc78dd3d.exe 28 PID 1948 wrote to memory of 1796 1948 56f34b3ab700e04ec7c3e8c7bc78dd3d.exe 28 PID 1948 wrote to memory of 1796 1948 56f34b3ab700e04ec7c3e8c7bc78dd3d.exe 28 PID 1948 wrote to memory of 1796 1948 56f34b3ab700e04ec7c3e8c7bc78dd3d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe"C:\Users\Admin\AppData\Local\Temp\56f34b3ab700e04ec7c3e8c7bc78dd3d.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\utsiawm\vpb.exe"C:\Program Files (x86)\utsiawm\vpb.exe"2⤵
- Executes dropped EXE
PID:1796
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
999KB
MD5a30dafd9850bca6816617a75f1a7ecc1
SHA13885166318dcec81992686775828c30c95ed374e
SHA256c3c568038a45a3ae50f1f736d116ec14a2ebfb40b22682629ef8438ddf3d6a78
SHA512cb932102ad0f374206dd6a41ff77949d3ab0d30fd0f2fdb137c9beedcbdd4c3abe507a1a150ed938909709d54fce8c010d7b1564844f9e652a6c798869f73bc0