Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 13:49
Static task
static1
Behavioral task
behavioral1
Sample
38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe
Resource
win10v2004-20231215-en
General
-
Target
38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe
-
Size
4.7MB
-
MD5
f358cef8566acc32bada93a9cecef20c
-
SHA1
00bcbe72815f04e7e8d7259894b7961e136f58fd
-
SHA256
38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3
-
SHA512
b568ebbc3bc728252a2ca9d1dbc1742d914a162b6504bb4658aa39373ca18bb0d5e89e57b18feb4a344d043748f25fba3157969b2a5b84747a3269b9c56b3702
-
SSDEEP
98304:ZhIHjWibmorLobjYE08GKdzOJDb4v+zlz:GWibmoZmwN0v+R
Malware Config
Signatures
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 2672 38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe 2672 38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe"C:\Users\Admin\AppData\Local\Temp\38d01f31f5848c1867dd1eae774fe99db06bbed13d35096bc65d456b30da84a3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2672
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
2KB
MD59203f4b036e0fc717331b147430f5931
SHA1c123fc960da1cfa6e7dcc2c3cd71aed3ae0d2757
SHA25607211af345a76b2aa26893404d12f4e04d233c66d81db068726065521319bcf8
SHA512dc5bc61ef04f9b228dec67ccd7c428e5411daa8bfd449e32a5aa96c8c5262a4c8204a3fc42880478f4c4c4d4013c293d67d3567091d979558cbb675f12ef2877
-
Filesize
4KB
MD5ff989e4fb22b4cc3760f6e5b483009e9
SHA1adf3f53a31e8ed33415bcb268f5856188ab76ee1
SHA2563462f993fb99f6186c260190181d5240965293498618b1bc2cc48ff28f27f1c0
SHA51268667bd03c98255dd4ddf902d7fd77271d1f2180c3fd2ed8250f7b8cbda89be55419021ea5fc0428149cbbd60569e920001b17fb9fa60bd4d007a86ab952fe7c
-
Filesize
38B
MD53894f2bd45d2f19940b98878996078f7
SHA1db555edf545fb5d62a4f23e45d5ac22034261fb7
SHA256b2aaf8c78d5450c47b6e87edfae59e57d1455346b0d24086021aab09dde8ac2c
SHA51295f0be958d925a234f98652c765f2b4f6695649e13d5a45256f2ab69c3507a957585385d26434b7bc63601a0dee9cb8a019ec8e2e243bdcff4281c6665e2239f
-
Filesize
3.0MB
MD55e0c540d5a379abd0bcf72e6caccb2c8
SHA199b4633222b8aa239a05243255a72e6f3308c1d5
SHA256dadc42ee06fc4a48f3600ab7f9ce725a1f116abe35707160586713df1fea13bd
SHA512a14d192049b2982349884d06b34e85e4b78b6d8ae1d0e5a331bd4c6e7aa92e8feaae760c8923df720cd35c8df75043fc7b23fb65a56211cc399603587c059927
-
Filesize
2.8MB
MD5ae7ae30c0bef16de33e2dc8bf6320935
SHA1e94a617e14291d25e04d4cf9946107d4496b8310
SHA25611aeabe0331b2ccad6a54e5154580fb45cccda3c38f90e02129fbd7d124dec8c
SHA51203d8f30e6e89a49343195526780932ed5ff2b6065a176607882842becee62c110dc77aa3869214f2eb26b36f2d166ae6cf6a9d43bdc6a657935b4ef55b329d42