Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
115a403a52dfae29a5d7b5057cc6270e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
115a403a52dfae29a5d7b5057cc6270e.exe
Resource
win10v2004-20231215-en
General
-
Target
115a403a52dfae29a5d7b5057cc6270e.exe
-
Size
115KB
-
MD5
115a403a52dfae29a5d7b5057cc6270e
-
SHA1
c13ca5b70499a8434c4f5a6a51564a4ec912dfbe
-
SHA256
0faf9f0416075dd9852ab4e2889830ede7a97fbc6bc2bc1f1ab3f71b8bb51989
-
SHA512
bf7c382b3ed1881ae626b23505e8d1cecbfe2c48ccc6e32a08d1d85a39e6b12d0d33ea7e0830a47ff59398a4f25d5e21812166052a24408477415f96707a93ed
-
SSDEEP
3072:YmpEp9xUWu1gGjXr2vwvEbMps2i/XHCob:YmpPTj7QIpsPZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2856 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2856 2168 115a403a52dfae29a5d7b5057cc6270e.exe 28 PID 2168 wrote to memory of 2856 2168 115a403a52dfae29a5d7b5057cc6270e.exe 28 PID 2168 wrote to memory of 2856 2168 115a403a52dfae29a5d7b5057cc6270e.exe 28 PID 2168 wrote to memory of 2856 2168 115a403a52dfae29a5d7b5057cc6270e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\115a403a52dfae29a5d7b5057cc6270e.exe"C:\Users\Admin\AppData\Local\Temp\115a403a52dfae29a5d7b5057cc6270e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Qqz..bat" > nul 2> nul2⤵
- Deletes itself
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD528387d644cb3963998b61b4f9ce3b6dc
SHA1448541b115b1c5110a370cb3820a291f3ac82090
SHA2569ebf60f9392869c9131e267abf257d0888228b36cb57b81c687a6df32b622b80
SHA51240d811d6a522c3ccef31615ba6eef7dca5d09608ea259e40eeab3fbac8e8bef044295f4c95859c65605dd1a6590f4bbcf38851c63c6945c033befac62015dc06