Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 04:54
Behavioral task
behavioral1
Sample
55d26709c485e1aab9338b70f0fdbf88.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
55d26709c485e1aab9338b70f0fdbf88.exe
Resource
win10v2004-20231215-en
General
-
Target
55d26709c485e1aab9338b70f0fdbf88.exe
-
Size
3.9MB
-
MD5
55d26709c485e1aab9338b70f0fdbf88
-
SHA1
c88c4bb3205ee6ad874c6450b4ca067cf8b895f8
-
SHA256
e1a136cf9b9c446555b264d288c93ea5a307c68a55c81b2697b80b94147611e0
-
SHA512
9c531be7f4eb3c0ca271a7ff919c14853a9ddba23abf4c99d16ae753324aec910438cdd5bb0e710197e92294b8990b2287ffa23d8cc27ebb2ea50b670c50917f
-
SSDEEP
98304:Ap9UAn8AuUQIV/fESYOAvV5q6mk2Hef8XSktswQO9KlZrua4S:a95ngQNYOAD64sQOgCzS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1592 IFinst27.exe -
resource yara_rule behavioral1/memory/532-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x000a00000001225a-8.dat upx behavioral1/memory/532-7-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1592-9-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/532-3-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/1592-10-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\IFinst27.exe 55d26709c485e1aab9338b70f0fdbf88.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 532 wrote to memory of 1592 532 55d26709c485e1aab9338b70f0fdbf88.exe 28 PID 532 wrote to memory of 1592 532 55d26709c485e1aab9338b70f0fdbf88.exe 28 PID 532 wrote to memory of 1592 532 55d26709c485e1aab9338b70f0fdbf88.exe 28 PID 532 wrote to memory of 1592 532 55d26709c485e1aab9338b70f0fdbf88.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d26709c485e1aab9338b70f0fdbf88.exe"C:\Users\Admin\AppData\Local\Temp\55d26709c485e1aab9338b70f0fdbf88.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\IFinst27.exe"C:\Windows\IFinst27.exe" -IC:\Users\Admin\AppData\Local\Temp\55d26709c485e1aab9338b70f0fdbf88.exe2⤵
- Executes dropped EXE
PID:1592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD59c17bca3ef837bacded7e4299508e71d
SHA1253c7e956ad6cb66e0e47e5d9a6a19d78e9c96e0
SHA2562405e5479aeb7d43d1362969b9c439e5931b8f900f9adfe0faaa986365415193
SHA51212c1c5dbdf763d6d361b9d412794b0d85b6134843114120b843f30db198a3a211e2c06eadd3ed25271b4cd06a7367df7dafc6b9b33b1bce479f3ad050caeb625