Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
52d3db430bf0acf7b98e3cf60a419449.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52d3db430bf0acf7b98e3cf60a419449.exe
Resource
win10v2004-20231215-en
General
-
Target
52d3db430bf0acf7b98e3cf60a419449.exe
-
Size
142KB
-
MD5
52d3db430bf0acf7b98e3cf60a419449
-
SHA1
ffbe4448e1e9d0507bdc4c662a7aaa45fb41f0bf
-
SHA256
6779e470f864e43d56f1c32f4ec69d23bbba07789f667903c0d843acccc1d92b
-
SHA512
acd96029f61a8c310115d9decb93c616690fe7ce0c43e58e6b8b1437b6596af4e6ebf0c84fafb3e8292825276b0a4b87ec42aededdf655a1093b0e5df62d056b
-
SSDEEP
3072:inOn7t7XpdpCCTg/sxFgJ6eqgKJ+BCJC8+Z/TAFZqlzvgYu:iKpdcCrTdgKY8k/TUgl0d
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2736 downloadmr.exe -
Loads dropped DLL 4 IoCs
pid Process 1200 52d3db430bf0acf7b98e3cf60a419449.exe 1200 52d3db430bf0acf7b98e3cf60a419449.exe 1200 52d3db430bf0acf7b98e3cf60a419449.exe 1200 52d3db430bf0acf7b98e3cf60a419449.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2736 downloadmr.exe 2736 downloadmr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1200 wrote to memory of 2736 1200 52d3db430bf0acf7b98e3cf60a419449.exe 28 PID 1200 wrote to memory of 2736 1200 52d3db430bf0acf7b98e3cf60a419449.exe 28 PID 1200 wrote to memory of 2736 1200 52d3db430bf0acf7b98e3cf60a419449.exe 28 PID 1200 wrote to memory of 2736 1200 52d3db430bf0acf7b98e3cf60a419449.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\52d3db430bf0acf7b98e3cf60a419449.exe"C:\Users\Admin\AppData\Local\Temp\52d3db430bf0acf7b98e3cf60a419449.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\nsi5562.tmp\downloadmr.exeC:\Users\Admin\AppData\Local\Temp\nsi5562.tmp\downloadmr.exe /u4f96c0af-ae48-469a-a08c-2bb95bc06f2f /e28322062⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD55ebc73650256e9c8ddbcda231db829a1
SHA1988d4535e18754ab2a6248abae96c5697d7dbcd5
SHA2561eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493
SHA512b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270
-
Filesize
122KB
MD5da254a8488b60244654e1cf4d6796cf8
SHA123d06f4589786652a3a226b5012a5520a3d03452
SHA2566d3b82a7ad74a1e88ae4d0f9176082130f1558fb3ff42a8b45ca8b80445efc2d
SHA512d311f90ad65441f6c7ae55220c2c3f117aa7601d083e6847e1b58b96c3c332d68a25d445310818396dc88678fb9ec5356f35a04a392c3d23746a2231e14b0a2e
-
Filesize
99KB
MD5880daf7c97dfda0068ef351785de7935
SHA1d96a329e756459018f5212ee627333fa6b224dcd
SHA256134b227dd9a5ce0accb308f0cd7c9b747b314e8bf5ee118dce7abc75db914983
SHA512527e3f39bd57abe6000460a9a1b0b9edb4412e7a6d35854c7297af91383f2dbdd59dfbf5770648666fba27da1a3751713e527eea8ce7e624301944582724e26a