Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
0146d7298802931da9acb5b0050d0063.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0146d7298802931da9acb5b0050d0063.exe
Resource
win10v2004-20231215-en
General
-
Target
0146d7298802931da9acb5b0050d0063.exe
-
Size
82KB
-
MD5
0146d7298802931da9acb5b0050d0063
-
SHA1
7f092530609baa416e263bd78509cf4f2059605b
-
SHA256
a12d0cf8f8cd5c2abdda31b33f1a967e993b2976c5635461314917a279a01a86
-
SHA512
46925d7ea72f37b8dadab45c6681335d56bd7ff108e717a37252b8b6d24017ab97bccb27b9f7357a6593840af50458791cd9084f68065b9009d14f2f73379b80
-
SSDEEP
1536:dIZvSK6RxOPPD+XgHcISECbcoZow+8LWqqJDXtxvgRzdNTq3Wy+3:2gFOCZEEc1w+nZJ7Py3P
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2120 0146d7298802931da9acb5b0050d0063.exe -
Executes dropped EXE 1 IoCs
pid Process 2120 0146d7298802931da9acb5b0050d0063.exe -
Loads dropped DLL 1 IoCs
pid Process 3024 0146d7298802931da9acb5b0050d0063.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3024 0146d7298802931da9acb5b0050d0063.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3024 0146d7298802931da9acb5b0050d0063.exe 2120 0146d7298802931da9acb5b0050d0063.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2120 3024 0146d7298802931da9acb5b0050d0063.exe 29 PID 3024 wrote to memory of 2120 3024 0146d7298802931da9acb5b0050d0063.exe 29 PID 3024 wrote to memory of 2120 3024 0146d7298802931da9acb5b0050d0063.exe 29 PID 3024 wrote to memory of 2120 3024 0146d7298802931da9acb5b0050d0063.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe"C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exeC:\Users\Admin\AppData\Local\Temp\0146d7298802931da9acb5b0050d0063.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2120
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD50d4ac82ba5af2d5093a86867f8ce9f05
SHA1d7ac641130e336e224c1e653769f4c3c5b885c7e
SHA2561def3a0a4117dd25d9c4a0769d254751bda0ef75e3e3882819e856f584bd9aee
SHA512f71d0b650a115481b6e2d651ba62b151b9f432deaab0feb193e6b18f72c039cd6a6cdd1af77123e7a499b8abb814ed36810d34f1b82cd6bcb35518d6c42edcd4