Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 23:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44a297cf8e98419e8987141cf66fe129.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
44a297cf8e98419e8987141cf66fe129.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
44a297cf8e98419e8987141cf66fe129.exe
-
Size
209KB
-
MD5
44a297cf8e98419e8987141cf66fe129
-
SHA1
4b504f0e5c28f0ff99137f1db06512fbbb2f4fa4
-
SHA256
3cb1b41ea234f3ee80f87f6a4e3ecab42cf7a076c4fe68861ab3d0596dbda404
-
SHA512
60d9a0896eab319cf8db5cd14bd93f8a4c89bebd9d2402733c27503a70f65d800b93b566c149d4838a08e74f3125fe2030b29fa3cc3a631f238ac472a73040b6
-
SSDEEP
6144:Kl8sGcdu3dgI7+26cePVetEtld4TbmlQCEPOoFYY7MF:OTdu3Kb2v5atlCbyYGy7M
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2832 u.dll 2648 mpress.exe 2400 u.dll 1780 mpress.exe -
Loads dropped DLL 8 IoCs
pid Process 1168 cmd.exe 1168 cmd.exe 2832 u.dll 2832 u.dll 1168 cmd.exe 1168 cmd.exe 2400 u.dll 2400 u.dll -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1816 wrote to memory of 1168 1816 44a297cf8e98419e8987141cf66fe129.exe 29 PID 1816 wrote to memory of 1168 1816 44a297cf8e98419e8987141cf66fe129.exe 29 PID 1816 wrote to memory of 1168 1816 44a297cf8e98419e8987141cf66fe129.exe 29 PID 1816 wrote to memory of 1168 1816 44a297cf8e98419e8987141cf66fe129.exe 29 PID 1168 wrote to memory of 2832 1168 cmd.exe 34 PID 1168 wrote to memory of 2832 1168 cmd.exe 34 PID 1168 wrote to memory of 2832 1168 cmd.exe 34 PID 1168 wrote to memory of 2832 1168 cmd.exe 34 PID 2832 wrote to memory of 2648 2832 u.dll 33 PID 2832 wrote to memory of 2648 2832 u.dll 33 PID 2832 wrote to memory of 2648 2832 u.dll 33 PID 2832 wrote to memory of 2648 2832 u.dll 33 PID 1168 wrote to memory of 2400 1168 cmd.exe 32 PID 1168 wrote to memory of 2400 1168 cmd.exe 32 PID 1168 wrote to memory of 2400 1168 cmd.exe 32 PID 1168 wrote to memory of 2400 1168 cmd.exe 32 PID 2400 wrote to memory of 1780 2400 u.dll 31 PID 2400 wrote to memory of 1780 2400 u.dll 31 PID 2400 wrote to memory of 1780 2400 u.dll 31 PID 2400 wrote to memory of 1780 2400 u.dll 31 PID 1168 wrote to memory of 1740 1168 cmd.exe 30 PID 1168 wrote to memory of 1740 1168 cmd.exe 30 PID 1168 wrote to memory of 1740 1168 cmd.exe 30 PID 1168 wrote to memory of 1740 1168 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\44a297cf8e98419e8987141cf66fe129.exe"C:\Users\Admin\AppData\Local\Temp\44a297cf8e98419e8987141cf66fe129.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\41E0.tmp\vir.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\calc.exeCALC.EXE3⤵PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save 44a297cf8e98419e8987141cf66fe129.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832
-
-
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\44EC.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe44ED.tmp"1⤵
- Executes dropped EXE
PID:1780
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\4318.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe4319.tmp"1⤵
- Executes dropped EXE
PID:2648