Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
89b48c2d597f74bbfeb9bcb3df410a81.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
89b48c2d597f74bbfeb9bcb3df410a81.exe
Resource
win10v2004-20231215-en
General
-
Target
89b48c2d597f74bbfeb9bcb3df410a81.exe
-
Size
757KB
-
MD5
89b48c2d597f74bbfeb9bcb3df410a81
-
SHA1
4a1ff552926f5caf1892a2c96fa4fd0e1fb5fbf5
-
SHA256
a7ac72fffdad0067658b52af3ad260c0b41b9e20876230743910b8715a74ea48
-
SHA512
cb5a41b98b6715dedd633c18e8746e8fa336bbd125f58494e9501eab1506aced698ab647d569945e3450a87c7bb31c84511089a846dcd31b0e6c6e21a76ff01e
-
SSDEEP
12288:VQi3O2gsv6m6URA3Phkzp1hf39Wkv8xwJC/:VQie2BChhgpdUMC/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2260 89b48c2d597f74bbfeb9bcb3df410a81.tmp -
Loads dropped DLL 4 IoCs
pid Process 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 2260 89b48c2d597f74bbfeb9bcb3df410a81.tmp 2260 89b48c2d597f74bbfeb9bcb3df410a81.tmp 2260 89b48c2d597f74bbfeb9bcb3df410a81.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2260 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 28 PID 2208 wrote to memory of 2260 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 28 PID 2208 wrote to memory of 2260 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 28 PID 2208 wrote to memory of 2260 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 28 PID 2208 wrote to memory of 2260 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 28 PID 2208 wrote to memory of 2260 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 28 PID 2208 wrote to memory of 2260 2208 89b48c2d597f74bbfeb9bcb3df410a81.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe"C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\is-BBCJM.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp"C:\Users\Admin\AppData\Local\Temp\is-BBCJM.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp" /SL5="$7011E,506086,422400,C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5090544331456bfb5de954f30519826f0
SHA18d0e1fa2d96e593f7f4318fa9e355c852b5b1fd4
SHA256b32cbc6b83581d4dc39aa7106e983e693c5df0e0a28f146f0a37bc0c23442047
SHA51203d5cbc044da526c8b6269a9122437b8d386530900e2b8452e4cf7b3d36fc895696cbe665e650a9afbdec4bad64a3dc0f6f5e1309e07f6f1407ec0643cac121d
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35