Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
07391365458c2475f1b0362e1e91c9d8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
07391365458c2475f1b0362e1e91c9d8.exe
Resource
win10v2004-20231215-en
General
-
Target
07391365458c2475f1b0362e1e91c9d8.exe
-
Size
1.0MB
-
MD5
07391365458c2475f1b0362e1e91c9d8
-
SHA1
df3c6753baf691a279c13dcbbf74de07821f8920
-
SHA256
dbaf74e7c1bcc29b8b031fc1a9bdb543af70f0049bc29625f3ffa92282ca0c8f
-
SHA512
da2a93f601ea6dcd3f80c95ba0e5ae531743efd6531edb2205aa81a6272d11a06a27d59d77c049c05e03df1028a40a20fe7f361e2da5b152d38b4acc97ee5200
-
SSDEEP
24576:v2UO/CgJ4bsjJgSpHeU1WTwCq7LuQoQihvoui7NNmH6swr:v2GgJOoCyHelC7KEX7NcH6swr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2524 07391365458c2475f1b0362e1e91c9d8.tmp -
Loads dropped DLL 4 IoCs
pid Process 2532 07391365458c2475f1b0362e1e91c9d8.exe 2524 07391365458c2475f1b0362e1e91c9d8.tmp 2524 07391365458c2475f1b0362e1e91c9d8.tmp 2524 07391365458c2475f1b0362e1e91c9d8.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2524 07391365458c2475f1b0362e1e91c9d8.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2524 2532 07391365458c2475f1b0362e1e91c9d8.exe 14 PID 2532 wrote to memory of 2524 2532 07391365458c2475f1b0362e1e91c9d8.exe 14 PID 2532 wrote to memory of 2524 2532 07391365458c2475f1b0362e1e91c9d8.exe 14 PID 2532 wrote to memory of 2524 2532 07391365458c2475f1b0362e1e91c9d8.exe 14 PID 2532 wrote to memory of 2524 2532 07391365458c2475f1b0362e1e91c9d8.exe 14 PID 2532 wrote to memory of 2524 2532 07391365458c2475f1b0362e1e91c9d8.exe 14 PID 2532 wrote to memory of 2524 2532 07391365458c2475f1b0362e1e91c9d8.exe 14
Processes
-
C:\Users\Admin\AppData\Local\Temp\is-OGUF2.tmp\07391365458c2475f1b0362e1e91c9d8.tmp"C:\Users\Admin\AppData\Local\Temp\is-OGUF2.tmp\07391365458c2475f1b0362e1e91c9d8.tmp" /SL5="$30138,854986,53248,C:\Users\Admin\AppData\Local\Temp\07391365458c2475f1b0362e1e91c9d8.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2524
-
C:\Users\Admin\AppData\Local\Temp\07391365458c2475f1b0362e1e91c9d8.exe"C:\Users\Admin\AppData\Local\Temp\07391365458c2475f1b0362e1e91c9d8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD516b07c42920914e41a5ca89c30bca0a3
SHA106cc4e8ee7ecff712ca10b230597d987f81555fd
SHA256999f5e99013b73d03e4342ad329af05cdd40da7c0b751d100ff0cb71f6fabf17
SHA5125e2ca0cc72472a01359db4bd845456fd76f9691ebb9736d5ce4693ff89f82a5015d49baca76ea1311b4f66caabe49eaa00446c92334a119ac4fad80dcb6b5492
-
Filesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba