Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:52
Behavioral task
behavioral1
Sample
0d819bbc31ae6f0fbd8fc1f359e8a566.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d819bbc31ae6f0fbd8fc1f359e8a566.exe
Resource
win10v2004-20231215-en
General
-
Target
0d819bbc31ae6f0fbd8fc1f359e8a566.exe
-
Size
56KB
-
MD5
0d819bbc31ae6f0fbd8fc1f359e8a566
-
SHA1
727be4d55b05dabdadf454366a3b729f6f055fec
-
SHA256
ade29640aacd15158cad35009b647053f5adce201b41fb0486623de4b2a72aae
-
SHA512
9c3cc2f8270074a03132fdfc5eaca2b7549e98d1cc3fac9cb205a9e0419bdef8ac3d6c061c5e2288d44b56836773fc51930d3db672e318e5eee8fbbb7449c1bd
-
SSDEEP
1536:gDqS/XCEYgC67HJsXFLtrRfqsn7KwbiIEMBoFHIvDcIf13:DkXY67HJslfVbiouFHIgQ3
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2368 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
Executes dropped EXE 1 IoCs
pid Process 2368 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
Loads dropped DLL 1 IoCs
pid Process 2152 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
resource yara_rule behavioral1/memory/2152-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2368-16-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000a000000012253-14.dat upx behavioral1/files/0x000a000000012253-10.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2152 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2152 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 2368 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2368 2152 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 17 PID 2152 wrote to memory of 2368 2152 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 17 PID 2152 wrote to memory of 2368 2152 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 17 PID 2152 wrote to memory of 2368 2152 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exe"C:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exeC:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2368
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD52a6145e5c5f6b0b9b4e4ab95fd9e78c8
SHA10df5a94d33e503a3aa4616834127d7b12daf4231
SHA25651d2f51a6135947b53a8476c56bf10dfca5c63674b1cc49c8ed02114a3623513
SHA512233f77b5451674a6d7310b5eb5e1c089dbd35c50c6a55c41b863dc7876768114889f3b9ea605bdb8ae9cc67ef4b984271e3b07fbeea052af25379de9d0386e38