Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11594390892fc4ba1f69fd4ecfbd7c52.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
11594390892fc4ba1f69fd4ecfbd7c52.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
11594390892fc4ba1f69fd4ecfbd7c52.exe
-
Size
1.9MB
-
MD5
11594390892fc4ba1f69fd4ecfbd7c52
-
SHA1
95d3daa6a1645cb27cacf1075fc7bfd7c95e3a8a
-
SHA256
4e2063a990faa7ac0a4b33fea0ff143bed723f3b0c957310835285804a9916fb
-
SHA512
112e00ddd5b4bd643e512c749fa7aafa656ce18d6351aeef8d9be70432fcf71886eb2734f8f3664d9ea9394324d5f33d693a8804c3dda80992230424d39a0863
-
SSDEEP
24576:N2oo60HPdt+1CRiY2eOBvcj3u10dCcSKr7hL1sWDYlSlck/AaLsbYF/dg/h1Wd0g:Qoa1taC070dCcS69OflqckZR62d3
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2772 BDB4.tmp -
Executes dropped EXE 1 IoCs
pid Process 2772 BDB4.tmp -
Loads dropped DLL 1 IoCs
pid Process 1840 11594390892fc4ba1f69fd4ecfbd7c52.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1840 wrote to memory of 2772 1840 11594390892fc4ba1f69fd4ecfbd7c52.exe 28 PID 1840 wrote to memory of 2772 1840 11594390892fc4ba1f69fd4ecfbd7c52.exe 28 PID 1840 wrote to memory of 2772 1840 11594390892fc4ba1f69fd4ecfbd7c52.exe 28 PID 1840 wrote to memory of 2772 1840 11594390892fc4ba1f69fd4ecfbd7c52.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\11594390892fc4ba1f69fd4ecfbd7c52.exe"C:\Users\Admin\AppData\Local\Temp\11594390892fc4ba1f69fd4ecfbd7c52.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\11594390892fc4ba1f69fd4ecfbd7c52.exe 75C42B4118A3544A8A059427409607894EBD8FC4A372D8FF17789A36D4DC0B18E178BC60823091F98382E2661676783F175B0E5E7BD3963CDD0F3B6235C23B282⤵
- Deletes itself
- Executes dropped EXE
PID:2772
-