Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
184s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
6c6798aeb2077816835020076274b65c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6c6798aeb2077816835020076274b65c.exe
Resource
win10v2004-20231215-en
General
-
Target
6c6798aeb2077816835020076274b65c.exe
-
Size
35KB
-
MD5
6c6798aeb2077816835020076274b65c
-
SHA1
27306040d1a74e348ff5c5d707fcdce87b9858ec
-
SHA256
52b45dbebe723b626a9d97981d7387fa77acc8042cbcea3486efff6292035cf1
-
SHA512
9405097c23047dfee6bf3ab867ef3e7d2d656974e8505a5969bf139a0084f677addd83505943a42388f62754f78100753d5ca0388b129cc19dfefc3e83f04de2
-
SSDEEP
768:cflivXrVKpVhKvtxwYHwVFoeAQumucwUI:ylqrVKprVuQuF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2596 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2772 6c6798aeb2077816835020076274b65c.exe 2772 6c6798aeb2077816835020076274b65c.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\2e25a684\jusched.exe 6c6798aeb2077816835020076274b65c.exe File created C:\Program Files (x86)\2e25a684\2e25a684 6c6798aeb2077816835020076274b65c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe 2596 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2596 2772 6c6798aeb2077816835020076274b65c.exe 29 PID 2772 wrote to memory of 2596 2772 6c6798aeb2077816835020076274b65c.exe 29 PID 2772 wrote to memory of 2596 2772 6c6798aeb2077816835020076274b65c.exe 29 PID 2772 wrote to memory of 2596 2772 6c6798aeb2077816835020076274b65c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6798aeb2077816835020076274b65c.exe"C:\Users\Admin\AppData\Local\Temp\6c6798aeb2077816835020076274b65c.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files (x86)\2e25a684\jusched.exe"C:\Program Files (x86)\2e25a684\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
35KB
MD5e6dfee9a3353a2f17ebec9cc48c21f39
SHA16968e64e023c701ed15d6a4370990a66b5d28d6d
SHA25651c9aaf834391dbf164a1281bbed796c77142384056ee262fa46d4c8ea25056d
SHA512813ad0e1a46e6dd9c90414e1ca47cdd515ca281c4eeefc652ccb7a06eb2dd1eb6d1039140651dd6a0dd362ff77a039d51486a3ac28dc2fa60294fecf784cb6a2