Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
33813141d96c8d537b56c00f492b86d8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
33813141d96c8d537b56c00f492b86d8.exe
Resource
win10v2004-20231215-en
General
-
Target
33813141d96c8d537b56c00f492b86d8.exe
-
Size
1.1MB
-
MD5
33813141d96c8d537b56c00f492b86d8
-
SHA1
0d8ebbc0889a6ecf599625bb3636bd9a0ff3e680
-
SHA256
213923d689922f8590cc822d62075841c80dc158b9281f05ec43d9f0de73ad56
-
SHA512
feb394a73836b87d4383a77f7c6a0178e795ecb213b23d33054b13d9e95102520c6c59f7af14e22abd24d46e62badaf9e395616122bf6f04f7eba385465698db
-
SSDEEP
12288:6Miy4IadS4ms5I6e66fEheKh6sfC444vk0kfyAfjfym0ArlDrmcZkQoxKk7HA4uO:6bSaE4mvt/H67AfKAr16CkQ8D7xD
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process 628 2908 WerFault.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0008000000016d79-62.dat nsis_installer_1 behavioral1/files/0x0008000000016d79-62.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\33813141d96c8d537b56c00f492b86d8.exe"C:\Users\Admin\AppData\Local\Temp\33813141d96c8d537b56c00f492b86d8.exe"1⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵PID:2600
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604521.txt bios get serialnumber1⤵PID:3044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 3681⤵
- Program crash
PID:628
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604521.txt bios get version1⤵PID:2904
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604521.txt bios get version1⤵PID:1792
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604521.txt bios get version1⤵PID:2892
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81703604521.txt bios get version1⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\ebjcabfbcebda.exeC:\Users\Admin\AppData\Local\Temp\ebjcabfbcebda.exe 6,9,6,2,1,8,2,0,6,7,7 KUdDQjwqMTMaKExPOUpHQzUuIClHPk5OSVBKQUI9KxkoPkBNUkg8OzIxLSotFylBSDw7MBooSUxGPlNCTF1JPjYqMDAuHi5LQ1JQPktZTExKPGBydGozKClqbHQtPENTRSZNSUcnP09ILElIP0gaJj1KSDtJST42KSsoMzU2LTQ3KisrLSgqLjUxLzczGSg+KDcjMygjNCo8RUM8SFIsPEAtQz0eLicfMi8YLUQsNiYrFylCMjUrMRooPS40Jy8fJ0I1NyYqGiZKUE48U0NOWElMQFA/QlE7IClJS0k7T0FTV0NVRjo2GiZKUE48U0NOWEc7RD87HydDWD9YTkxDNx4uPVZFWTxGPkNDTEQ1Hi9CSExOVjxQTk9RRUw2KxomTkZARklZSU5YT0lGOx8nVE03KxkpO00vPBgtUk9HTUNEP11WPUpDSUY+Q0Q7RURNUEw3GShDSllQVEZSSUc+Nm5pb2MfJ1BFTk5LSEBIRV5NUUVMWD07UE07MRgtSEM9PlI0Kx4uQVFfPlJHO0RDQV49TENMUklOPD47ZVlqc18ZKD5GUUxLRz9EWUJJNygzNi0pMTcoKykoLRotU0FLRTcqLSwwLjQ4LzQ1Gig9SU5ISk45Ql9OQkY/NC4tMDEtMioqLiQtNDM1Mi41JElGGiZPPzxFbXpjZWVbHCxkNCYuKyJQYmhbaXVyI0xUJS8nKyAlP29oamVRXltFYG4jMV4zMzEnLDAiIklHTEtMHytcJWNjaWQjRWVdZGgjIj1mcWdrZR8rXy4pKC4tKjExKycyKiJNX2VZcGkfK18vKjEsMi4eL09LRTdfbnJvHTFhHytfHylgZWRscC4qKisqXihnbV5tJSxfS29lTmdsXUJvcWdlaVheS2BmX2dfa1heXGpqbnEjMmAqLSwwLjQ4LzQ2HytfKyssNzMuNzcwLx4sXSsyMTEyNjMwLzAcLWQ0Ly4yMCsqLi8wM1hkMzBIPGgzWXRpcERRNGJRTSpuR1JIb0p4L2ZIPW5wTVNBZWI+cG1CYy5xTjoyMEZhMXNDdDdESS5CRE1MKzpKQXNBT0IqbkRzOG5LQkpiYWdhX1MpSGROO2l4RnNGK0VkQ3RFUXNuRHNHbUVnMylMU2VxRz09Y1cxKW1PdD5iXWRIcE47cQ==1⤵PID:2908
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
92KB
MD5bac600218861e8da0ceaa34cd4b62f8e
SHA167eb0013849ec5ed02b768d2fc3e0004df03487e
SHA2566e0ba4d98d1e7f1233f07152183c3ca31086ef0259c2fd1e021857145aed2694
SHA51247c69eb4ef18e40914c8e08bcee714f1f5e40fded9c51a6f6ce05c3198f6665b86da18cb6e288cf84c76711dd7e880d4d8c55e931ae15629ae94001b603b0818
-
Filesize
92KB
MD583f792dfa7bcff4c986dcc34345ff78a
SHA18a638d1465cd7a93553929789d903b5f7f950f29
SHA2567d8a3d7f131fbed1fcf2028142f1d380306845790c96c82f5f1e5f0f3786a120
SHA51293d71b16dbd8f115f30a76e01a3a5f2f02fc4685ea8011737cbfbc2ee35ee629bb4656ac784d55b859adfd48360de597119452b3fb8f6de1a7dbe6be8b5e76e4
-
Filesize
126KB
MD5a5ae3669d1a88e8d5379e188e2fc585b
SHA1aa53b8ed5f49f7308f3667cb04285370447e0f74
SHA25693cfe42e77397e7856456f04a7fd164550eeb3f1ae023c78daa12e72506b1566
SHA512d788c0a3710c8cf37e75cfb1259d464676b8da02131b523908ba531f59df1aa74577a8073753a33505a6af05fcb4d16e87cec27b546dfe26074ef4b7c18de19f