Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 08:42
Static task
static1
Behavioral task
behavioral1
Sample
12bc0b139f9551db690e45e42949ebec.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
12bc0b139f9551db690e45e42949ebec.exe
Resource
win10v2004-20231215-en
General
-
Target
12bc0b139f9551db690e45e42949ebec.exe
-
Size
110KB
-
MD5
12bc0b139f9551db690e45e42949ebec
-
SHA1
070467f60f6ec9ac1a7ef67826750bbc07d3abdf
-
SHA256
43f69e87dcb0f5320fa280d274ac2bb7a0141aa17bfad60d5f4cbad437a56154
-
SHA512
90825b94e06da7ae7b7b4fb447721be1ed39a4491949b0915fa07a5a7a921080d4163dbeea78b7662ae64e54e9f3a15e5662ff1b3734542548480430694dd69c
-
SSDEEP
1536:h0LFGxfLR3JaTNjDTJIBTtL9qfEovoWODtaqPhNm1ekqan27MI:hMGh1Ja1q3L9qfHIDbJNvV
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2192 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2192 2320 12bc0b139f9551db690e45e42949ebec.exe 21 PID 2320 wrote to memory of 2192 2320 12bc0b139f9551db690e45e42949ebec.exe 21 PID 2320 wrote to memory of 2192 2320 12bc0b139f9551db690e45e42949ebec.exe 21 PID 2320 wrote to memory of 2192 2320 12bc0b139f9551db690e45e42949ebec.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\12bc0b139f9551db690e45e42949ebec.exe"C:\Users\Admin\AppData\Local\Temp\12bc0b139f9551db690e45e42949ebec.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pfb..bat" > nul 2> nul2⤵
- Deletes itself
PID:2192
-