Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
1d7a6c287212cc8db18700695d3356e6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d7a6c287212cc8db18700695d3356e6.exe
Resource
win10v2004-20231215-en
General
-
Target
1d7a6c287212cc8db18700695d3356e6.exe
-
Size
592KB
-
MD5
1d7a6c287212cc8db18700695d3356e6
-
SHA1
b3cc8232f4a445c9dc035d38bc24cdc4f84e285f
-
SHA256
7e58ccda1c21273054defd9e4adaa769a96ad92fc92dd489c661627b0a183e78
-
SHA512
209f05021bf9145899f2d547fd113e31c959c8e7d74cd363f544a65d9eece248b50a275513d974f2366e3c0397d9db9e23ddfde67c789e9ee555e2ed8202a5af
-
SSDEEP
12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVYcrKZnfJPE:qKeyxTAJj7P+yW6mc1YgeZfZE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4568 kqv.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\ohziw\kqv.exe 1d7a6c287212cc8db18700695d3356e6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4568 4760 1d7a6c287212cc8db18700695d3356e6.exe 87 PID 4760 wrote to memory of 4568 4760 1d7a6c287212cc8db18700695d3356e6.exe 87 PID 4760 wrote to memory of 4568 4760 1d7a6c287212cc8db18700695d3356e6.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d7a6c287212cc8db18700695d3356e6.exe"C:\Users\Admin\AppData\Local\Temp\1d7a6c287212cc8db18700695d3356e6.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\ohziw\kqv.exe"C:\Program Files (x86)\ohziw\kqv.exe"2⤵
- Executes dropped EXE
PID:4568
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
610KB
MD535c72ec6b3f287e11c0d5546916ee344
SHA16ae7e63643967a203f0add12bb9f349e7cfeb3e4
SHA2569e24f11916a82db30ad5c87757a018baddf9297104a8106360342ef6913f1835
SHA512db211e53c24eb008fee2b1e25f9db520a3540a48a27ce5d3e5a19344e6e4f3e40a3ec0dc249b691053c06ec945b06f3042ffec90d6882dd0cfcb487352aa24cd
-
Filesize
382KB
MD58293303248329351a484cf4e7f0c0241
SHA1e82fb6b4fe894d2b7248ae8e3bb0e7fe29f7a08a
SHA256c4a8f7fc74eabaf8dc06e1956a2cb1398668fa098faac1437b0454d172f2f7bb
SHA5128d56811c3d192b204fd4ce36629a3ff6e83c9943afc3e04041bc41e66945f35b3585079ab6ce8e9f964820fed5391515b65a71c50fdae113dfe5e466efc10e51