Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 03:36
Static task
static1
Behavioral task
behavioral1
Sample
50e5afcce73cf163ea3e5cda30f9351d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
50e5afcce73cf163ea3e5cda30f9351d.exe
Resource
win10v2004-20231215-en
General
-
Target
50e5afcce73cf163ea3e5cda30f9351d.exe
-
Size
632KB
-
MD5
50e5afcce73cf163ea3e5cda30f9351d
-
SHA1
7ce8cc5ec6327d041d0dd71ba6c861b91662add1
-
SHA256
70e19bda20de5019ebfa6c5c1e1a13e4e01f8cc6af21bee841e8fffe97ef1f7f
-
SHA512
e1899fc730e555122b8e9646780bb67caabb6aec5993adc3e84a21b0585dedf6b2f3bcbfa2f6476a496466571389fb9bc0af2e1bfa027919d25625b20345890b
-
SSDEEP
12288:mGwF8DRXgVPqaoXNoEixlbjDm+3z2AJLDl16ncmglhRvpwkFDv6Rfa/Bqyw2VB:7zXKqa8SEijjC+37li6hPr6Rigy9B
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 764 klooss.exe -
Loads dropped DLL 1 IoCs
pid Process 1864 50e5afcce73cf163ea3e5cda30f9351d.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\vbqxpva\klooss.exe 50e5afcce73cf163ea3e5cda30f9351d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1864 wrote to memory of 764 1864 50e5afcce73cf163ea3e5cda30f9351d.exe 27 PID 1864 wrote to memory of 764 1864 50e5afcce73cf163ea3e5cda30f9351d.exe 27 PID 1864 wrote to memory of 764 1864 50e5afcce73cf163ea3e5cda30f9351d.exe 27 PID 1864 wrote to memory of 764 1864 50e5afcce73cf163ea3e5cda30f9351d.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\50e5afcce73cf163ea3e5cda30f9351d.exe"C:\Users\Admin\AppData\Local\Temp\50e5afcce73cf163ea3e5cda30f9351d.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\vbqxpva\klooss.exe"C:\Program Files (x86)\vbqxpva\klooss.exe"2⤵
- Executes dropped EXE
PID:764
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD5ce5076356f5e791c6d611cbcc748446f
SHA14d53927073c6059cd7dcc51708a2557b9d15f0cd
SHA2569339a9096bc56176ccbf67018043fa54423ccc3a5bc397d0b55ae7ac75d45ce9
SHA5120c33cd300df284862e06e7de3d3073dc9c5ab038de35d24f23749cb4f507663ee7ff4fe6678436df9900442882fa1586426403aabf17feb4bc5ff467e9bf1ad2