Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
0f0c7324453038e6938111bec98ec3dc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f0c7324453038e6938111bec98ec3dc.exe
Resource
win10v2004-20231215-en
General
-
Target
0f0c7324453038e6938111bec98ec3dc.exe
-
Size
237KB
-
MD5
0f0c7324453038e6938111bec98ec3dc
-
SHA1
859024670ac5a0ce2cdb0870c784f1dafb1f8ce3
-
SHA256
aabed1d94478998313a2febdd907b0e8db9b6b77a37756832c24a0bd3d2dfc0b
-
SHA512
9389bb41992b3c0f60c3aa606e507b99e75aec87114c07e7953ebc03837a40753ad24707ccabda8bc57870ffabe8acfe90f0caebfcbd9697835a56d50d783e42
-
SSDEEP
3072:4gT4yixFw1ZzaQtXfecw3OX8TOto3JeNNpMWh7enP+taqy3UV9TC3dpDftXZ0C:qKPzaQt2TRBZeNMe7enGzy3Vfbh5
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
pid Process 2844 phqghum.exe 2584 phqghum.exe 2148 phqghum.exe 1960 phqghum.exe 1872 phqghum.exe 1376 phqghum.exe 2096 phqghum.exe 2068 phqghum.exe 2400 phqghum.exe 868 phqghum.exe -
Loads dropped DLL 20 IoCs
pid Process 1984 0f0c7324453038e6938111bec98ec3dc.exe 1984 0f0c7324453038e6938111bec98ec3dc.exe 2844 phqghum.exe 2844 phqghum.exe 2584 phqghum.exe 2584 phqghum.exe 2148 phqghum.exe 2148 phqghum.exe 1960 phqghum.exe 1960 phqghum.exe 1872 phqghum.exe 1872 phqghum.exe 1376 phqghum.exe 1376 phqghum.exe 2096 phqghum.exe 2096 phqghum.exe 2068 phqghum.exe 2068 phqghum.exe 2400 phqghum.exe 2400 phqghum.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\phqghum.exe 0f0c7324453038e6938111bec98ec3dc.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe 0f0c7324453038e6938111bec98ec3dc.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File created C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe File opened for modification C:\Windows\SysWOW64\phqghum.exe phqghum.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2844 1984 0f0c7324453038e6938111bec98ec3dc.exe 28 PID 1984 wrote to memory of 2844 1984 0f0c7324453038e6938111bec98ec3dc.exe 28 PID 1984 wrote to memory of 2844 1984 0f0c7324453038e6938111bec98ec3dc.exe 28 PID 1984 wrote to memory of 2844 1984 0f0c7324453038e6938111bec98ec3dc.exe 28 PID 2844 wrote to memory of 2584 2844 phqghum.exe 29 PID 2844 wrote to memory of 2584 2844 phqghum.exe 29 PID 2844 wrote to memory of 2584 2844 phqghum.exe 29 PID 2844 wrote to memory of 2584 2844 phqghum.exe 29 PID 2584 wrote to memory of 2148 2584 phqghum.exe 30 PID 2584 wrote to memory of 2148 2584 phqghum.exe 30 PID 2584 wrote to memory of 2148 2584 phqghum.exe 30 PID 2584 wrote to memory of 2148 2584 phqghum.exe 30 PID 2148 wrote to memory of 1960 2148 phqghum.exe 33 PID 2148 wrote to memory of 1960 2148 phqghum.exe 33 PID 2148 wrote to memory of 1960 2148 phqghum.exe 33 PID 2148 wrote to memory of 1960 2148 phqghum.exe 33 PID 1960 wrote to memory of 1872 1960 phqghum.exe 34 PID 1960 wrote to memory of 1872 1960 phqghum.exe 34 PID 1960 wrote to memory of 1872 1960 phqghum.exe 34 PID 1960 wrote to memory of 1872 1960 phqghum.exe 34 PID 1872 wrote to memory of 1376 1872 phqghum.exe 35 PID 1872 wrote to memory of 1376 1872 phqghum.exe 35 PID 1872 wrote to memory of 1376 1872 phqghum.exe 35 PID 1872 wrote to memory of 1376 1872 phqghum.exe 35 PID 1376 wrote to memory of 2096 1376 phqghum.exe 36 PID 1376 wrote to memory of 2096 1376 phqghum.exe 36 PID 1376 wrote to memory of 2096 1376 phqghum.exe 36 PID 1376 wrote to memory of 2096 1376 phqghum.exe 36 PID 2096 wrote to memory of 2068 2096 phqghum.exe 37 PID 2096 wrote to memory of 2068 2096 phqghum.exe 37 PID 2096 wrote to memory of 2068 2096 phqghum.exe 37 PID 2096 wrote to memory of 2068 2096 phqghum.exe 37 PID 2068 wrote to memory of 2400 2068 phqghum.exe 38 PID 2068 wrote to memory of 2400 2068 phqghum.exe 38 PID 2068 wrote to memory of 2400 2068 phqghum.exe 38 PID 2068 wrote to memory of 2400 2068 phqghum.exe 38 PID 2400 wrote to memory of 868 2400 phqghum.exe 39 PID 2400 wrote to memory of 868 2400 phqghum.exe 39 PID 2400 wrote to memory of 868 2400 phqghum.exe 39 PID 2400 wrote to memory of 868 2400 phqghum.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f0c7324453038e6938111bec98ec3dc.exe"C:\Users\Admin\AppData\Local\Temp\0f0c7324453038e6938111bec98ec3dc.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 584 "C:\Users\Admin\AppData\Local\Temp\0f0c7324453038e6938111bec98ec3dc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 536 "C:\Windows\SysWOW64\phqghum.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 524 "C:\Windows\SysWOW64\phqghum.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 528 "C:\Windows\SysWOW64\phqghum.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 540 "C:\Windows\SysWOW64\phqghum.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 544 "C:\Windows\SysWOW64\phqghum.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 560 "C:\Windows\SysWOW64\phqghum.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 548 "C:\Windows\SysWOW64\phqghum.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 564 "C:\Windows\SysWOW64\phqghum.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\phqghum.exeC:\Windows\system32\phqghum.exe 568 "C:\Windows\SysWOW64\phqghum.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:868
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190KB
MD5cb7d7c9c566b6e7fef9042e5fa9591ee
SHA19e8517f787447be6d88569bed93701a4c2ec26ac
SHA25620adaa10aba8579df2014fd044f1ad60a7a59b9d2cc7c16b9760db2f64a80d52
SHA512c2986bb370825dd0768d603d2c25477d5a8c235f91a9f155657ceae8189e77bd14699b4e7d62a014c7b6d611fb03d566d668600d5f174ffed099ea7c54f4e413
-
Filesize
12KB
MD5013e61abc525bf15e138ae260c1fa330
SHA1b6a73c882cc361ce756bbad58bef5cd278a1ecfd
SHA2567bb96916140719eae0628368d27a73be456950346a17369d863b1b957da51af7
SHA51254971499549011ac969c84a4603cd5154433ceab52c85f466e34945ac0d38d0798bdcc8fec6f3ca01e40afabd85985ed1b82b0fe9eaa68199b11c64deb6b179f