Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
bd3cfd9434cde404285cb1e8dba872b5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bd3cfd9434cde404285cb1e8dba872b5.exe
Resource
win10v2004-20231215-en
General
-
Target
bd3cfd9434cde404285cb1e8dba872b5.exe
-
Size
1.9MB
-
MD5
bd3cfd9434cde404285cb1e8dba872b5
-
SHA1
03c10858c6eb6de5a36d4bd5cfb9f00349614b05
-
SHA256
29ac9e2a57ced8b7042664ff313c53e1797d37cc13ab614e511c637cff8b858f
-
SHA512
7ff1621628120b5473632f6691b525bfc7f6ac37cbe1aa152dab09bebff360d7a7797164bd654919f243626272e581a2c9b71b25e41834ac95f95dd379030a76
-
SSDEEP
49152:Qoa1taC070dRN/7XnHy2myzxtVl5Tx6y64:Qoa1taC0sN/73y2rxtVl5TN64
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 808 453A.tmp -
Executes dropped EXE 1 IoCs
pid Process 808 453A.tmp -
Loads dropped DLL 1 IoCs
pid Process 2096 bd3cfd9434cde404285cb1e8dba872b5.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 808 2096 bd3cfd9434cde404285cb1e8dba872b5.exe 28 PID 2096 wrote to memory of 808 2096 bd3cfd9434cde404285cb1e8dba872b5.exe 28 PID 2096 wrote to memory of 808 2096 bd3cfd9434cde404285cb1e8dba872b5.exe 28 PID 2096 wrote to memory of 808 2096 bd3cfd9434cde404285cb1e8dba872b5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd3cfd9434cde404285cb1e8dba872b5.exe"C:\Users\Admin\AppData\Local\Temp\bd3cfd9434cde404285cb1e8dba872b5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\bd3cfd9434cde404285cb1e8dba872b5.exe C432A25B27F13D7DC8538CD368354DB6A996FE9F03EA67DF57EB2BA8D81BD695D903164596497559D17CEE13626FB48A97EF9523B48AAD15584C0D9409BE61CD2⤵
- Deletes itself
- Executes dropped EXE
PID:808
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57639f3f5cb7eca9152b3f273e22ec4b6
SHA1f2334bc7dd6962d438eb374af823f0b784b9becf
SHA25632548b862237f0a7ebac7f1f13f5f7fed843fde11dba347d636087eef7a6bda4
SHA512fbfd9cde756c12babfb4426908f53a3a1e88104e4d2451904aa5d78b995d222877aaefa7a69bc1096d9aed141779d03b63357a380064c90c82578f83878b3254