Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:15
Static task
static1
Behavioral task
behavioral1
Sample
11e5796bb3701b17358fd60128b707c5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
11e5796bb3701b17358fd60128b707c5.exe
Resource
win10v2004-20231215-en
General
-
Target
11e5796bb3701b17358fd60128b707c5.exe
-
Size
144KB
-
MD5
11e5796bb3701b17358fd60128b707c5
-
SHA1
67f52e1482fe2267b59762a70090237fe764f463
-
SHA256
95787e34f1bbaf3942c8af22805ce57ba2aa43e8964f630606219844fa56847e
-
SHA512
dec7defc75dbb402e2349951ab3555eb40ff4484a07cd32fd191e39cd3867f0b3ea20c4449c69b1c5b07ace19c014dc9f28cf7706f69658a55541d5b37122186
-
SSDEEP
3072:V7GeKlH/SvQ0tRpSFsOTHHrdT+cT3B0DBpq7qZ2o2LlmSbReH:Vvs/6HMZHkDBZZ2bLlm
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2992 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2992 2356 11e5796bb3701b17358fd60128b707c5.exe 27 PID 2356 wrote to memory of 2992 2356 11e5796bb3701b17358fd60128b707c5.exe 27 PID 2356 wrote to memory of 2992 2356 11e5796bb3701b17358fd60128b707c5.exe 27 PID 2356 wrote to memory of 2992 2356 11e5796bb3701b17358fd60128b707c5.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\11e5796bb3701b17358fd60128b707c5.exe"C:\Users\Admin\AppData\Local\Temp\11e5796bb3701b17358fd60128b707c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ddz..bat" > nul 2> nul2⤵
- Deletes itself
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD5514d60e0de26ece51d94e005c17556cf
SHA1d8ee5b3465d479a96b06ca97550952214c8dfc92
SHA2560331ba7b54dc6dac4431c8ad35eb2ab1992b8db55266d5a59240efb446bb76f4
SHA51294076698b45c51cd1fca26cb8b5f3fd89a483032d33ffc0584fb0098b9a6b2e6dc4194bd09f163e4fa813eddc03d3c65982d98a3b9a859957ae8963091d2dddc