Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 05:05
Static task
static1
Behavioral task
behavioral1
Sample
569335ab90141b8fff29c9f84a5535eb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
569335ab90141b8fff29c9f84a5535eb.exe
Resource
win10v2004-20231215-en
General
-
Target
569335ab90141b8fff29c9f84a5535eb.exe
-
Size
94KB
-
MD5
569335ab90141b8fff29c9f84a5535eb
-
SHA1
8cc615007cc127d385b55b0360c34549423f86b9
-
SHA256
587e83ddfc378176004ecddc8751733e32776c0567e701402b83e681ed2c290b
-
SHA512
3f90c0feca85815ca2599c671802ba2fbb2a349e404fd0667a90ad871df0facbf134e9085edda9e39e9cd17075ccd65bb5c201c99e14f3aa7bd1ba4acab03645
-
SSDEEP
1536:vfg+M2Y9oH+cpTKeyaI0Z/od8bDbRvU5yYeVYXrgITAGXBB3exYEjpepikFIy:vfgyY9oH+cTKGI0Z/oooeVYXrgI0GXW4
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2360 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2360 1708 569335ab90141b8fff29c9f84a5535eb.exe 29 PID 1708 wrote to memory of 2360 1708 569335ab90141b8fff29c9f84a5535eb.exe 29 PID 1708 wrote to memory of 2360 1708 569335ab90141b8fff29c9f84a5535eb.exe 29 PID 1708 wrote to memory of 2360 1708 569335ab90141b8fff29c9f84a5535eb.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\569335ab90141b8fff29c9f84a5535eb.exe"C:\Users\Admin\AppData\Local\Temp\569335ab90141b8fff29c9f84a5535eb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Hlj..bat" > nul 2> nul2⤵
- Deletes itself
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD52f86f88a05b22f446d33b23c1ea045a4
SHA12965774f1d8ff5a20666ef0e272348b035fa05b8
SHA256a49bc0b7f43a51a9c21af9ea8899f96cfaa06cfcf619f3ce0a13494667c21e43
SHA512da1c91bdbc97f05296f5d81e9292c2f7479793febc05d4660b1a20d35e88265fbae35ee7c01d14105c122bd6a9a55b813d7d054affbc1446ffca3f37e2f781a6