Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 13:33
Behavioral task
behavioral1
Sample
Liquid_Launchpad/Liquid_Launchpad.exe
Resource
win7-20231215-en
General
-
Target
Liquid_Launchpad/Liquid_Launchpad.exe
-
Size
16.0MB
-
MD5
4d16f7ccb5733a04fd1a31514029e987
-
SHA1
b97162b50316f2e8317a650786f7b2ff749c411e
-
SHA256
001e2f7c446b4a7b58aea6240850507a4b0b38192a87016f546aefa8dbaf62a1
-
SHA512
4393e1a65008d5f875ce6eaa62f00dff068ce2604dd8f24c31c82de8faee17b5b24292464c2ced64a9938d3a6941bb2f86875e9d8d9a110ebfd155c8505be325
-
SSDEEP
393216:LiIE7YoSD2ntpUTLfhJsW+eGQRCMTozGxu8C0ibfz6e57e1bmXdWCUI:47rSDaHUTLJSW+e5RLoztZ026e58kVUI
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2652 Liquid_Launchpad.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 828 wrote to memory of 2652 828 Liquid_Launchpad.exe 28 PID 828 wrote to memory of 2652 828 Liquid_Launchpad.exe 28 PID 828 wrote to memory of 2652 828 Liquid_Launchpad.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Liquid_Launchpad\Liquid_Launchpad.exe"C:\Users\Admin\AppData\Local\Temp\Liquid_Launchpad\Liquid_Launchpad.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\Liquid_Launchpad\Liquid_Launchpad.exe"C:\Users\Admin\AppData\Local\Temp\Liquid_Launchpad\Liquid_Launchpad.exe"2⤵
- Loads dropped DLL
PID:2652
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
775KB
MD5ca4cf24f7eae730d47fb033249ac0fd7
SHA1ce6e0adf551c3f738e78633ec78d73e0b1abdf9e
SHA25698ed711612d814b105ea9cfdc975b6bc16e7a415dd6b84ee5425c40dc2e5ec8a
SHA512ef8f456a1fa4d360044e225961561d633ac1d71ca0076925cd53bdac7c1af40ab9864d150809eac4831b7d192f1eee38921b0498f16e680f276656775e80321f
-
Filesize
6.7MB
MD548ebfefa21b480a9b0dbfc3364e1d066
SHA1b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA2560cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
SHA5124e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce