Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
d0157aa1316c9b772545b8f469eafc0b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d0157aa1316c9b772545b8f469eafc0b.exe
Resource
win10v2004-20231215-en
General
-
Target
d0157aa1316c9b772545b8f469eafc0b.exe
-
Size
11KB
-
MD5
d0157aa1316c9b772545b8f469eafc0b
-
SHA1
3eb26ac22470678ef9f0250e02691641a012d571
-
SHA256
e37615f09542956bf3bb227566ae2a01b9aef790af786ac3277cf7845a5dcfdd
-
SHA512
59a6be74c8b07166958023ee6785283c69b26ab8c9d77c41eb7d192d4498264554c589f787890b904243eb2a6a6e5285388c487045b5dbf8852cee666b2394ba
-
SSDEEP
96:ZRm3QC3oSXGdTfwIqYwnumr4CX/Hx/HfpV5MIefyVnfYC2gLSw:XiQC3oSWdHwnzr9V/bpVnAC3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2172 ymjrx.exe -
Loads dropped DLL 2 IoCs
pid Process 2768 d0157aa1316c9b772545b8f469eafc0b.exe 2768 d0157aa1316c9b772545b8f469eafc0b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2172 2768 d0157aa1316c9b772545b8f469eafc0b.exe 28 PID 2768 wrote to memory of 2172 2768 d0157aa1316c9b772545b8f469eafc0b.exe 28 PID 2768 wrote to memory of 2172 2768 d0157aa1316c9b772545b8f469eafc0b.exe 28 PID 2768 wrote to memory of 2172 2768 d0157aa1316c9b772545b8f469eafc0b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0157aa1316c9b772545b8f469eafc0b.exe"C:\Users\Admin\AppData\Local\Temp\d0157aa1316c9b772545b8f469eafc0b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\ymjrx.exe"C:\Users\Admin\AppData\Local\Temp\ymjrx.exe"2⤵
- Executes dropped EXE
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5ac657caba8a538a4ca05d7a55d41f08f
SHA18617e3d5ad9cde6c79e4f9efa202bf97e49ade8a
SHA25605c629e0ea6deb2165338b6164635adf91879cf966ffe41302db1d82652a37c5
SHA512e02176012f316ce532829f0c4f820a90f154b8d3882377d5d178c228a60863cd8a7798d23333d23195b2a3eeb18573082e7585523f7cdd4ad0464185890bfd70