Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
3a9f072f55b3c9a0008915b28790b507.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a9f072f55b3c9a0008915b28790b507.exe
Resource
win10v2004-20231222-en
General
-
Target
3a9f072f55b3c9a0008915b28790b507.exe
-
Size
361KB
-
MD5
3a9f072f55b3c9a0008915b28790b507
-
SHA1
f2c6068e6f30d22cb0ff74c58643b2e51e468b01
-
SHA256
b3766bf2e2c92774e4ce29cf14f260583d8604065204c6d755a5d942a8e87f1b
-
SHA512
fc6df10769b15dff0e01dbe02d3852a4415bb5f055953121a2e1b7bbc8907ed75335cacf70a2fbf28b67a7a3a6fe4f8915a09ddaa894d4a8f75a600b8b21406a
-
SSDEEP
6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j7W4+yQrOx5YsRC:MLry/neyx7f/A64j7P+tixhRC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2716 wplczos.exe -
Loads dropped DLL 1 IoCs
pid Process 2668 3a9f072f55b3c9a0008915b28790b507.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\rosykatvge\wplczos.exe 3a9f072f55b3c9a0008915b28790b507.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2716 2668 3a9f072f55b3c9a0008915b28790b507.exe 28 PID 2668 wrote to memory of 2716 2668 3a9f072f55b3c9a0008915b28790b507.exe 28 PID 2668 wrote to memory of 2716 2668 3a9f072f55b3c9a0008915b28790b507.exe 28 PID 2668 wrote to memory of 2716 2668 3a9f072f55b3c9a0008915b28790b507.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe"C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files (x86)\rosykatvge\wplczos.exe"C:\Program Files (x86)\rosykatvge\wplczos.exe"2⤵
- Executes dropped EXE
PID:2716
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD579bf46829ac7e532e29463ed5e1fe5a0
SHA18101e1d16f360094d83d39ae35e2cae59e3914c9
SHA256546d983db78488d2897a2f2d35f466fa5b616bb3bdbbafa8fe49af5ee1852324
SHA5123c26a1178c9c7273073b90d39ddbc8172201b29375c894a2927a4aa69f12a24f04f6bad952976dba28f62091ffcf560a6e2c46c7701d002c9de176d430f1a214