Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
065efcc8172fbdc6916d65d77b101ec6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
065efcc8172fbdc6916d65d77b101ec6.exe
Resource
win10v2004-20231222-en
General
-
Target
065efcc8172fbdc6916d65d77b101ec6.exe
-
Size
71KB
-
MD5
065efcc8172fbdc6916d65d77b101ec6
-
SHA1
41c7a0880e231c04c7ee3e0e0244f95b721ce395
-
SHA256
24db0cfa7e369fc21ea6237fdd2a3f484c6674d6a91af7e34e7da77a2b64f332
-
SHA512
fbcf98d643d456b990d055e0150477c7f2d2b7743d98ecbcf2f8371fb9e39c543dbc6c56914ab31067b013751ee0fe36183f04d4dcf72486071dc9fe5bcf2e28
-
SSDEEP
1536:jXPc908oY7rpn3SEbu2zBBls7qCMOt+WYjdy4As3EM:jX/YfOWCMqYxys3b
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2448 wxperyt32.exe 3628 wxperyt32.exe 4608 wxperyt32.exe 3568 wxperyt32.exe 3300 wxperyt32.exe 4324 wxperyt32.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\wxperyt32.exe wxperyt32.exe File created C:\Windows\SysWOW64\wxperyt32.exe wxperyt32.exe File created C:\Windows\SysWOW64\wxperyt32.exe wxperyt32.exe File created C:\Windows\SysWOW64\wxperyt32.exe 065efcc8172fbdc6916d65d77b101ec6.exe File opened for modification C:\Windows\SysWOW64\wxperyt32.exe 065efcc8172fbdc6916d65d77b101ec6.exe File created C:\Windows\SysWOW64\wxperyt32.exe wxperyt32.exe File created C:\Windows\SysWOW64\wxperyt32.exe wxperyt32.exe File created C:\Windows\SysWOW64\wxperyt32.exe wxperyt32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 1788 065efcc8172fbdc6916d65d77b101ec6.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 2448 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 3628 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 4608 wxperyt32.exe 3568 wxperyt32.exe 3568 wxperyt32.exe 3568 wxperyt32.exe 3568 wxperyt32.exe 3568 wxperyt32.exe 3568 wxperyt32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2448 1788 065efcc8172fbdc6916d65d77b101ec6.exe 91 PID 1788 wrote to memory of 2448 1788 065efcc8172fbdc6916d65d77b101ec6.exe 91 PID 1788 wrote to memory of 2448 1788 065efcc8172fbdc6916d65d77b101ec6.exe 91 PID 2448 wrote to memory of 3628 2448 wxperyt32.exe 99 PID 2448 wrote to memory of 3628 2448 wxperyt32.exe 99 PID 2448 wrote to memory of 3628 2448 wxperyt32.exe 99 PID 3628 wrote to memory of 4608 3628 wxperyt32.exe 104 PID 3628 wrote to memory of 4608 3628 wxperyt32.exe 104 PID 3628 wrote to memory of 4608 3628 wxperyt32.exe 104 PID 4608 wrote to memory of 3568 4608 wxperyt32.exe 106 PID 4608 wrote to memory of 3568 4608 wxperyt32.exe 106 PID 4608 wrote to memory of 3568 4608 wxperyt32.exe 106 PID 3568 wrote to memory of 3300 3568 wxperyt32.exe 111 PID 3568 wrote to memory of 3300 3568 wxperyt32.exe 111 PID 3568 wrote to memory of 3300 3568 wxperyt32.exe 111 PID 3300 wrote to memory of 4324 3300 wxperyt32.exe 116 PID 3300 wrote to memory of 4324 3300 wxperyt32.exe 116 PID 3300 wrote to memory of 4324 3300 wxperyt32.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\065efcc8172fbdc6916d65d77b101ec6.exe"C:\Users\Admin\AppData\Local\Temp\065efcc8172fbdc6916d65d77b101ec6.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\wxperyt32.exeC:\Windows\system32\wxperyt32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\wxperyt32.exeC:\Windows\system32\wxperyt32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\wxperyt32.exeC:\Windows\system32\wxperyt32.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\wxperyt32.exeC:\Windows\system32\wxperyt32.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\wxperyt32.exeC:\Windows\system32\wxperyt32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\wxperyt32.exeC:\Windows\system32\wxperyt32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4324
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5065efcc8172fbdc6916d65d77b101ec6
SHA141c7a0880e231c04c7ee3e0e0244f95b721ce395
SHA25624db0cfa7e369fc21ea6237fdd2a3f484c6674d6a91af7e34e7da77a2b64f332
SHA512fbcf98d643d456b990d055e0150477c7f2d2b7743d98ecbcf2f8371fb9e39c543dbc6c56914ab31067b013751ee0fe36183f04d4dcf72486071dc9fe5bcf2e28