Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
130401c7bd47fd5772fe61ee7e37199a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
130401c7bd47fd5772fe61ee7e37199a.exe
Resource
win10v2004-20231222-en
General
-
Target
130401c7bd47fd5772fe61ee7e37199a.exe
-
Size
209KB
-
MD5
130401c7bd47fd5772fe61ee7e37199a
-
SHA1
d3d4c6f8c16403ea0cafd0857ca51579a5d764f1
-
SHA256
8392e8ebc86eb5bebab49ea05619f7f52f350224d7d308e34be7d818aa85981c
-
SHA512
07b6c451f1ebe41671ba3369bf4622cab20de6591c547fd59862a6f557f60fc12f5a6f2051713ce92439c5b23ccdea0ce293af1dfcd43e063329c1c6ff53e77b
-
SSDEEP
6144:VltGmukwuqEBv9KgZI4Szs66U4e8lVkw2AnhW1Hg:NGmN1Z9uzsKF8f6n1
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1788 u.dll 2832 u.dll 2572 mpress.exe -
Loads dropped DLL 6 IoCs
pid Process 2000 cmd.exe 2000 cmd.exe 2000 cmd.exe 2000 cmd.exe 2832 u.dll 2832 u.dll -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 624 wrote to memory of 2000 624 130401c7bd47fd5772fe61ee7e37199a.exe 17 PID 624 wrote to memory of 2000 624 130401c7bd47fd5772fe61ee7e37199a.exe 17 PID 624 wrote to memory of 2000 624 130401c7bd47fd5772fe61ee7e37199a.exe 17 PID 624 wrote to memory of 2000 624 130401c7bd47fd5772fe61ee7e37199a.exe 17 PID 2000 wrote to memory of 1788 2000 cmd.exe 16 PID 2000 wrote to memory of 1788 2000 cmd.exe 16 PID 2000 wrote to memory of 1788 2000 cmd.exe 16 PID 2000 wrote to memory of 1788 2000 cmd.exe 16 PID 2000 wrote to memory of 2832 2000 cmd.exe 33 PID 2000 wrote to memory of 2832 2000 cmd.exe 33 PID 2000 wrote to memory of 2832 2000 cmd.exe 33 PID 2000 wrote to memory of 2832 2000 cmd.exe 33 PID 2832 wrote to memory of 2572 2832 u.dll 32 PID 2832 wrote to memory of 2572 2832 u.dll 32 PID 2832 wrote to memory of 2572 2832 u.dll 32 PID 2832 wrote to memory of 2572 2832 u.dll 32 PID 2000 wrote to memory of 2440 2000 cmd.exe 31 PID 2000 wrote to memory of 2440 2000 cmd.exe 31 PID 2000 wrote to memory of 2440 2000 cmd.exe 31 PID 2000 wrote to memory of 2440 2000 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe"C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1008.tmp\vir.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\calc.exeCALC.EXE3⤵PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832
-
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save 130401c7bd47fd5772fe61ee7e37199a.exe.com -include s.dll -overwrite -nodelete1⤵
- Executes dropped EXE
PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe2BF1.tmp"1⤵
- Executes dropped EXE
PID:2572
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f4720d714f192b79325554ae2bd89910
SHA1bf53cdb9960e0a9ff3ee202b87853c7534423eb0
SHA25690a2c39393b94e6490207859fe3be74fe0c2e530afcc11531ff777ed2c0d08e7
SHA512c6739943b9280b5040dfae3703cdf21fef1ca583b8525d68337647b4ae579fa1df7fa38357af0c7c5eee0f4b375287e1378b304efe72bf79a25a89fc5b245ddb
-
Filesize
92KB
MD53ead3d1666a7ba5496ca7f0bdba490e6
SHA11c2707e1ed0b80eceb9e222e7c12e922e1ad1a13
SHA2569c86a7b9cbd93a18253b5101b8a4272f9396e752177b5a49520384df06f18f5d
SHA512147d684c5f73aa2aadc05c01c9aa31e887242edf53b97f151024ddf84384b2517dc6bd9a7bb52d9c607f47583b7b4868e809ad042e7f8e951e6a331004c62335